How to run splunk add monitor without providing user name/password on Win 2012 R2

[rajindersingh]

I am setting up splunk universal forwarder on a windows server 2012 R2 in a fully automated manner.
I have been able to MSI to install splunk. I tried setting up file monitor during the installation and that did not work for some reason.

Now I am trying to setup directory monitoring with splunk add monitor c:\xxxx but I am being prompted for user name and password.
Is there any way to suppress this? I am running this command as local admin user. My VM is not domain joined.

Other thing I noticed is that when I add monitor via command line this information does not show up in input.conf. Is this expected behavior?

[jtrucks]

The username and password the splunk command uses on the CLI is the same it would use for the GUI. That means it is requesting a Splunk username/password combination, like admin/changeme (the default for a new splunk install) or whatever combination you have set up for an admin user that would have permissions to run the command. You can't not have it prompt for that unless you first run $SPLUNK_HOME\bin\splunk login to have a running session.

The added monitor may land in a ...\local\inputs.conf file in a number of places under $SPLUNK_HOME\etc, so do a search for inputs.conf in that directory to find the various places that may contain your new entry or entries.

Alternatively, have something add your monitor stanza to the $SPLUNK_HOME\etc\system\local\inputs.conf file. For details on writing that stanza, see the docs at http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Input.

[rajindersingh]

splunk is running as a localsystem account.
It does have access to the file system.

I ran splunk add monitor d:\logs and I can see references to d:\logs in splunkd-utility.logs file.
If I run splund list monitor It does show the logs files that were in d:\logs
I don't see the logs show up on the indexer.

I tried restarting the splunk sever but it did not help.
Since splunk list monitor is showing the log files it is storing configuration somewhere but not in input.conf file.

If I manually insert the lines you shared above and restart the service everything works as expected.

I was hoping to avoid updating text files to configure this server but I can do that if it is the only reliable way to configure splunk.

This VM is running in Microsoft Azure and it is a stateless VM so automation is the only way to get splunk forwarder configured.

[krish3]

Just look at this location you should have your entry.

$Splunk_HOME$\etc\apps\search\local\inputs.conf

[krish3]

Does splunk as permission to read and write files under its home directory. Just try adding below lines in input.conf and make sure it is present and restart splunk and share the output. And verify the contents in inputs.conf after splunk comes up.

[monitor://c:\location\to\folder]
disabled = false
followTail = true
index = main