Inputs.Conf - Historical Logging - Chicken and the Egg?

[vragosta]

I know that you can control the Universal Forwarder to grab historical event logs from Windows using "current_only = 1", but... how do you install the Universal Forwarder without it starting the SplunkForwarder service automatically?

In other words, you can't modify inputs.conf, before it exits, to force it to not send over historical logs, correct? Am I missing something?

Thanks!

[jeff · Accepted solution]

Option 1: Install with the command line parameter STARTSPLUNK=0 to not have Splunk forwarder start automatically (with caveats- see command line installer documentation.

Option 2: Install splunk, point to a deployment server during installation. Keep all other defaults (no receiving indexer, no logs to monitor, etc). On your deployment server, create one or more apps with all of the appropriate settings for your environment... this is what we do. See deployment server documentation.

[vragosta]

Thanks! CLI options work great.