Universal forwarder scripted install

[aberdamy]

Does anyone know if it is possible to automatically add the current_only = [0|1] attribute in a scripted Universal Forwarder install? The inputs.conf I am referencing is located here:

C:\Program Files (x86)\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf

[WinEventLog://Application]
disabled = 0
current_only = 1

[WinEventLog://Security]
disabled = 0
current_only = 1

[WinEventLog://System]
disabled = 0
current_only = 1

[martin_mueller]

Have you considered rolling out the inputs.conf (and its surrounding app) automatically, using the Splunk Deployment Server or any 3rd party configuration management tool?
That would not only simplify your scripted install, but would also make future maintenance nightmares disappear.

As for your question itself, you can do this from the CLI:

splunk _internal call /servicesNS/nobody/Splunk_TA_windows/properties/inputs/WinEventLog%3A%2F%2FSecurity/current_only -post:value 1 -auth admin:pass

That should be integrateable into your install script.

[martin_mueller]

You'd have to run that after Splunk's installation, and probably only while it's running.

It might be easier to add that line to the config file directly from your script, especially if you already are writing to inputs.conf.

[aberdamy]

We are rolling the Universal Forwarder out via SCCM and we have a batch file that looks at the Operating system architecture and writes to the "/etc/system/local inputs.conf" file to monitor the firewall log if it is a Windows 2003 system. Would the splunk_internal call command work with this? If so, where would I insert it? Part of batch:

start /wait msiexec /i splunkforwarder-6.msi
INSTALLDIR="%PROGRAMFILES%\SplunkUniversalForwarder" RECEIVING_INDEXER="server:9997" WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 DISPLAY_WINDOWS_TA_DIALOG=1 LAUNCHSPLUNK=0 /quiet