Getting Data In

Installation Universal Forwarder on Citrix Provisioning servers


Hi there,

i followed the install instructions for the installation of the splunk UF in our Citrix environment.
We used this command for the installation on the master.
msiexec.exe /i splunkforwarder-7.0.3-fa31da744b51-x64-release.msi DEPLOYMENT_SERVER="<IP ADDRESS>:8089" AGREETOLICENSE=yes LAUNCHSPLUNK=0 /quiet

The preperation of the master image works fine.

After we start the first provisioned server with this image, we saw that the UF communicates with the deployment server and received the prepared inputs.conf, outputs.conf. And a few minutes later we received some events from the event log on the indexer. So far everythings works as expected.

But if we restart the provisioned server, the image of the server will be reseted and therefore the previosly generated "GUID" of the server is gone. After the splunk UF service is started again, the service will generate a new guid.
On the splunk master server in the Forwarders:Deployment menu we see for each reboot a new entry of the UF for the provisioned server.

Is there a way to set to the provisioned servers always the same guid? Is it possible to deploy the instance.cfg by the deployment server?

Any help / info is welcome.


0 Karma


Just for information,

we found a solution for our environment. It is pretty simple. We wrote a powershell script which is executed every startup of the provisioned servers. This script make the following changes:
- remove the file "cloneprep"
- add or replace the hostname from "inputs.conf"
- add or replace the servername from "server.conf"
- create or change the "instances.cfg" with a self created guid.

We test this a couple of times and it looks like to work fine. The logfiles from the UF are looking good. No errors or warnings regarding the self created GUID.

After all these changes from the configuration part, the script checks the successfull changes and startup the SplunkForwarder service on the server.

For the moment our problem is solved with this script but if someone has another approach, please let me know.


Hello @krusty !

Have you found any other way to solve this problem?

Can you please also provide powershell script that you wrote? 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!