Why aren't my command line flags working when installing a Universal Forwarder (UF) via Power Shell on Windows?

[hettervik]

Hi,

I'm testing an install of a Splunk UF on a Windows server using the Power Shell command line. The server is supposed to be used as a golden image for provisioning, so I have to prepare the UF for cloning. The Power Shell command I'm using is the following.

msiexec.exe /i .\splunkforwarder-7.0.1-<id>-x64-release.msi AGREETOLICENSE=Yes DEPLOYMENT_SERVER="<servername>" LAUNCHSPLUNK=0 CLONEPREP=1 SERVICESTARTTYPE=manual SPLUNKPASSWORD=<password> /quiet

My problem is that some of the flags don't seem to have any effect on it at all. The flags AGREETOLICENSE, DEPLOYMENT_SERVER, and LAUNCHSPLUNK all works fine, but the flags CLONEPREP and SERVICESTARTTYPE do nothing. The UF service is still sat to "automatic", and the servername of the host I'm installing on is still written to server.conf and inputs.conf. I get no output on the terminal indicating that something is wrong.

Also, I've asked the Splunk Documentation Team about the CLONEPREP flag and they confirmed that the flag should work with recent versions of the software.

Does anyone have any idea on why the flags aren't working, or how to troubleshoot this issue?

[jhornsby_splunk]

Hi @hettervi,

Unfortunately SERVICESTARTTYPE does not work. We have a bug tracking that issue. It looks like CLONEPREP should, though. If you enable MSI logging, do the logs mention "ClonePrepClearConfig" at all?

Cheers,

- Jo.

[hettervik]

Hi @jhornsby,

Thanks! That would explain why SERVICESTARTTYPE doesn't work. I guess the easiest solution to make the service "manual" is to use a GPO in Windows, or perhaps add an additional service-change command in Power Shell after the msiexec-command.

About CLONEPREP, I actually found out something interesting just today. It started working if I removed the SPLUNKPASSWORD flag. If I uninstalled the UF and added the SPLUNKPASSWORD flag again, it stopped working.

I haven't looked in the logs yet for further troubleshooting.

[jhornsby_splunk]

Hi @hettervi,

Yeah, either of those should work. Don't forget to make sure that the msiexec.exe has finished using Out-Null, or whatever! &:)

And interesting about the CLONEPREP vs SPLUNKPASSWORD thing. I may look into that as part of a different issue I'm working on.

Cheers,

- Jo.

[althomas]

It's a dull answer, but unfortunately it's because they're not supported flags (at least according to the documentation)

https://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonWindowsviathecommandline

[hettervik]

Hi. You're looking at the install documentation for Splunk Enterprise. I'm looking to install a Splunk UF. The document for installing a Windows universal forwarder (version 7.0.1) from the command line states that the flags I'm mentioning should be usable.

http://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/InstallaWindowsuniversalforwarderfrom...

[althomas]

Ah right you are -- sorry