Installing universal forwarder on a gold image

[brianmhs]

Hello!

I'm trying to make the splunk forwarder part of my gold image template for windows servers. 

Right now, I have a script that installs the forwarder using vmware customization once the VM is cloned from it's template. I would instead like to install the forwarder on the gold image itself and get rid of the script.

I am using directions from a splunk document. The 3rd section titled "Clone and restore the image" does not make sense to me, it seems to be saying clone the same image 2 or 3 times. 

1. Restart the machine and clone it with your favorite imaging utility.
2. After cloning the image, use the imaging utility to restore it into another physical or virtual machine.
3. Run the cloned image. Splunk services start automatically.
4. Use the CLI to restart Splunk Enterprise to remove the cloneprep information:

Step 1 - ok so I have cloned my gold image into another machine (that I would think can be used for prod)

Step 2- Why do I need to restore the cloned VM to another machine?

Step 3 - ok

Step 4 - This is pretty inconvenient, this makes me have to either manually do something, or script it which I'm trying not to do.

This may be terminology confusion on my part, but is there not a way to completely configure the forwarder on the gold image, and when I clone it using vmware, it just comes up and works?

https://docs.splunk.com/Documentation/Splunk/8.2.4/Admin/Integrateauniversalforwarderontoasystemimag...

[SinghK]

For the 4th step you will have to do that as when you start making image or template it keeps the info like servername etc in config it needs to be cleaned out clean prep config needs to be done and I can send you the script as s well for same l but that I can do tomorrow I will need to check it, created that long ago and it worked just fine. Do let me know.. this the most imp step or you face issues later.

[SinghK]

For the 4th step you will have to do that as when you start making image or template it keeps the info like servername etc in config it needs to be cleaned out clean prep config needs to be done and I can send you the script as s well for same l but that I can do tomorrow I will need to check it, created that long ago and it worked just fine. Do let me know..

[brianmhs]

Does step # 4 (splunk restart) need to be done on the gold image itself, or on the new VM that is created from the template?

[SinghK]

It has to be done on VM's. You can try keeping the template boxes offline and run the script on them may be you will have to use batch script there but it's always easier to fix vm's. 

[brianmhs]

I ran a test by doing all the steps except for the final step 4 (splunk restart from cmd line). The newly created VM is sending events to the collector, and my searches work ok. So I'm curious what type of issue is caused by not running that final reboot to get rid of the \$SPLUNKHOME\cloneprep file?

[SinghK]

That final reboot will happen either now or after patching on servers so it going to happen and then it will either stop reporting or report in with image name..