I have installed the UF(.v 10.2.1) on a Windows server using the cli command below. Splunk appears to install successfully and the user.seed.conf is copied to 'C:\Program Files\SplunkUniversalForwarder\etc\system\local\user-seed.conf'. However, when I start Splunk the user-seed.conf file doesn't get deleted and any attempts to perform command line configurations result in 'Login Failed' errors. Any insight on what I'm missing/failing to do?
msiexec.exe /i C:\tmp\SplunkUniversalForwarder.msi AGREETOLICENSE=Yes LAUNCHSPLUNK=0 RECEIVING_INDEXER="192.168.10.10:9997" /qn
@Stem Most probably, the user-seed file is not being parsed, likely due to syntax, or permissions. You may review the Splunkd logs to figure out the issue.
Make sure to follow the below syntax for the user-seed.conf file. Any deviation (extra spaces, wrong section header) will cause Splunk to ignore it.
[user_info]
USERNAME = admin
PASSWORD = <yourpassword>
Confirm the Splunk service account has read access to the file. On Windows, run Splunk as Administrator during installation or startup.
Ref:
user-seed.conf | Platform (last updated 2026-01-13T21:03:58.807Z)
>>
If this post addressed your question, you can:
Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.
>>
Check the splunkd.log but generally that's happening if either splunkd cannot access the file or it has syntax errors.
This appears to be the resolution to my issue. Installing Splunk .v 10.2.1 with the 'LAUNCHSPLUNK=0 ' parameter still generates a passwd file during installation. Deleting the file before first start allows the user-seed.conf file to be read and deleted. Thanks to all for your help!