Installing Universal Forwarder with no configuration.

[adrianathome]

I am looking to install the UF across my organization. We will use deployment tool to deploy and manage the the UF + any apps/configs.

According to this link the required installation flags are

     1. AGREETOLICENSE=Yes
     2. RECEIVING_INDEXER="<server:port>"
     3. At least one data input flag, such as WINEVENTLOG_APP_ENABLE=1. You can add as many data input flags as you need. 

However, I wish to agree to license and continue installation with no other configuration. Our deployment solution will then pass the config files as an app after installation and restart the forwarder.

How can I accomplish this?

[kristian_kolb]

If you intend to use the Deployment Server, the only additional setting you need is the ip:port of the DS. Then you can configure the rest as deployed applications, including outputs.conf.

MSIEXEC.EXE /i <splunk-installer.msi> DEPLOYMENT_SERVER=ip:port AGREETOLICENSE=Yes

as per the the first example in the docs;

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/DeployaWindowsdfviathecommandline#Examples

/Kristian

[adrianathome]

No deployment server. We will use a 3rd party tool to manage configs.

[gkanapathy · Accepted solution]

This is slightly outdated in details, but it should help:

http://wiki.splunk.com/Deploying_Splunk_Light_Forwarders

As for the RECEIVING_INDEXER flag, I believe it is inaccurate that it is required. Only the AGREETOLICENSE flag is required by the installer.

[adrianathome]

Msiexec.exe /a did not work. However, msiexec.exe /i splunk.msi /qn AGREETOLICENSE=yes did work. It threw a couple off errors but at the end it installed.

[gkanapathy]

actually, now that i think about it, i'm not sure the AGREETOLICENSE flag is required. if you are scripting your install to a high degree (like you might do on Unix), then you may also want to use the msiexec's "administrative install" option, "msiexec /a", which I believe will simply put the Splunk files in place and not run any first-time run scripts. If you do this, though, you will have to script in a "splunk enable boot-start" and a "splunk start --accept-license" in your own script. This is not really documented, and it not strictly a Splunk option, but a Windows msiexec option.

[adrianathome]

Will confirm later today.

[asimagu]

You should be able to do the install without any inputs.

If you are using a deployment server, you can always configure the inputs in the apps that you are deploying.

So, once you install the package via rpm or untarring it:

splunkforwarder/bin/splunk --accept-license enable boot-start
splunkforwarder/bin/splunk set deploy-poll
vi splunkforwarder/etc/splunk-launch.conf
SPLUNK_BINDIP=127.0.0.1
/etc/init.d/splunk restart

[asimagu]

good call, by default I usually do that coz I have to in my systems, I will edit my answer, thanks

[kristian_kolb]

Unless you have a very good reason, don't run as root.