Automated UF Deployment to Mac and Bypassing Splunk's Little Helper

Path Finder

Hi Splunkers.

I'm wondering how people out there are deploying the UF to Mac fleets

We are trying to deploy the Splunk UF to MacOS machines in an automated fashion.
i.e. Scripted so that it requires no input from the user.

If we try the install by extracting the .tgz, Big Sur complains that it cannot confirm the Splunk executables are legitimate and blocks the install.

Accordingly, when we deploy via the .dmg (scripted), partway through the install Splunk's Little Helper pops up.  Although we can click through this, this breaks the unattended workflow we are trying to use for the installation 

Note that we are performing any configuration items needed from the command line such as:

- Setting admin credentials using the user-seed file.
- Starting Splunk up for the first ime with the --accept-license option.
- Setting Splunk to start on boot up.

This means we don't need (or want) Splunk's Little Helper to run.
We just need the install to finish without any interaction with the user.

Is there any way of running the install without the helper popping up?
Alternatively, is there an alternative way people doing scripted UF installs on Macs that requires no user interaction/click-throughs or Splunks Little helper popping up during install?

I've not found any special options to prevent this from popping up.

Version of Splunk UF being installed is  Macos is BigSur.

Thanks in advance.

Labels (3)
Tags (4)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...