Command prompt MSI installation - does this look right?

[mctester]

I was wondering if there is a switch for the MSI installation that will limit the log files to current data only on installation of Splunk on Windows. in addition, can you review my MSI script, we only want to forward Windows Security Events.

I found in the forum there is a different way of installing that sets current_only in one of the configuration files. We would prefer to use the MSI installation method.

my current MSI deployment is to only forward Security events, we would like to only forward current data.

msiexec.exe /i Splunkx64.msi SPLUNK_APP=SplunkLightForwarder WINEVENTLOGAPPCHECK=0 WINEVENTLOGSECCHECK=1 WINEVENTLOGSYSCHECK=0 WINEVENTLOGFWD=1 WINEVENTLOGSETCHECK=1 FORWARD_SERVER=splunk.mednet.ucla.edu:9997 

[Mick · Accepted solution]

ftk is correct, there's no way to specify the current_only flag with the CLI.

For a large scale implementation, deployment server is definitely the way you should be heading. With that in place, all you would need to do at installation time is just a vanilla install, and then the first time you start it up run the command to enable the deployment client. It will then go off and grab all the configs you need -

splunk set deploy-poll <IP address or hostname>:<port>

In the next major version we will be adding a flag to the CLI MSI install that will allow you to configure the deployment feature at install time, but for now it will have to be an extra step.

[gkanapathy · Accepted solution]

Please see this http://answers.splunk.com/questions/434/can-i-auto-install-or-deploy-splunk-onto-all-my-remote-windo... for best practices for mass installations on Windows.

[Mick · Accepted solution]

ftk is correct, there's no way to specify the current_only flag with the CLI.

For a large scale implementation, deployment server is definitely the way you should be heading. With that in place, all you would need to do at installation time is just a vanilla install, and then the first time you start it up run the command to enable the deployment client. It will then go off and grab all the configs you need -

splunk set deploy-poll <IP address or hostname>:<port>

In the next major version we will be adding a flag to the CLI MSI install that will allow you to configure the deployment feature at install time, but for now it will have to be an extra step.

[ftk]

This setting is not exposed via a command line switch. I recommend you use the LAUNCHSPLUNK=0 switch to not start splunk after installation, then edit your inputs.conf (or drop a standard one into place) to include the current_only setting, and then finally starting the splunk instance with the new config in place.

This can all be added to a simple batch script that can easily be farmed out to all your servers.

Alternatively I would look into using a deployment server to push out the configurations to your forwarders.