Getting Data In

Installing Universal Forwarder with no configuration.

adrianathome
Communicator

I am looking to install the UF across my organization. We will use deployment tool to deploy and manage the the UF + any apps/configs.

According to this link the required installation flags are

     1. AGREETOLICENSE=Yes
     2. RECEIVING_INDEXER="<server:port>"
     3. At least one data input flag, such as WINEVENTLOG_APP_ENABLE=1. You can add as many data input flags as you need. 

However, I wish to agree to license and continue installation with no other configuration. Our deployment solution will then pass the config files as an app after installation and restart the forwarder.

How can I accomplish this?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

This is slightly outdated in details, but it should help:

http://wiki.splunk.com/Deploying_Splunk_Light_Forwarders

As for the RECEIVING_INDEXER flag, I believe it is inaccurate that it is required. Only the AGREETOLICENSE flag is required by the installer.

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

If you intend to use the Deployment Server, the only additional setting you need is the ip:port of the DS. Then you can configure the rest as deployed applications, including outputs.conf.

MSIEXEC.EXE /i <splunk-installer.msi> DEPLOYMENT_SERVER=ip:port AGREETOLICENSE=Yes

as per the the first example in the docs;

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/DeployaWindowsdfviathecommandline#Examples

/Kristian

0 Karma

adrianathome
Communicator

No deployment server. We will use a 3rd party tool to manage configs.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This is slightly outdated in details, but it should help:

http://wiki.splunk.com/Deploying_Splunk_Light_Forwarders

As for the RECEIVING_INDEXER flag, I believe it is inaccurate that it is required. Only the AGREETOLICENSE flag is required by the installer.

View solution in original post

0 Karma

adrianathome
Communicator

Msiexec.exe /a did not work. However, msiexec.exe /i splunk.msi /qn AGREETOLICENSE=yes did work. It threw a couple off errors but at the end it installed.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

actually, now that i think about it, i'm not sure the AGREETOLICENSE flag is required. if you are scripting your install to a high degree (like you might do on Unix), then you may also want to use the msiexec's "administrative install" option, "msiexec /a", which I believe will simply put the Splunk files in place and not run any first-time run scripts. If you do this, though, you will have to script in a "splunk enable boot-start" and a "splunk start --accept-license" in your own script. This is not really documented, and it not strictly a Splunk option, but a Windows msiexec option.

0 Karma

adrianathome
Communicator

Will confirm later today.

0 Karma

asimagu
Builder

You should be able to do the install without any inputs.

If you are using a deployment server, you can always configure the inputs in the apps that you are deploying.

So, once you install the package via rpm or untarring it:

splunkforwarder/bin/splunk --accept-license enable boot-start
splunkforwarder/bin/splunk set deploy-poll
vi splunkforwarder/etc/splunk-launch.conf
SPLUNK_BINDIP=127.0.0.1
/etc/init.d/splunk restart

0 Karma

asimagu
Builder

good call, by default I usually do that coz I have to in my systems, I will edit my answer, thanks

0 Karma

kristian_kolb
Ultra Champion

Unless you have a very good reason, don't run as root.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!