Installation

Command prompt MSI installation - does this look right?

mctester
Communicator

I was wondering if there is a switch for the MSI installation that will limit the log files to current data only on installation of Splunk on Windows. in addition, can you review my MSI script, we only want to forward Windows Security Events.

I found in the forum there is a different way of installing that sets current_only in one of the configuration files. We would prefer to use the MSI installation method.

my current MSI deployment is to only forward Security events, we would like to only forward current data.

msiexec.exe /i Splunkx64.msi SPLUNK_APP=SplunkLightForwarder WINEVENTLOGAPPCHECK=0 WINEVENTLOGSECCHECK=1 WINEVENTLOGSYSCHECK=0 WINEVENTLOGFWD=1 WINEVENTLOGSETCHECK=1 FORWARD_SERVER=splunk.mednet.ucla.edu:9997 
0 Karma
2 Solutions

Mick
Splunk Employee
Splunk Employee

ftk is correct, there's no way to specify the current_only flag with the CLI.

For a large scale implementation, deployment server is definitely the way you should be heading. With that in place, all you would need to do at installation time is just a vanilla install, and then the first time you start it up run the command to enable the deployment client. It will then go off and grab all the configs you need -

splunk set deploy-poll <IP address or hostname>:<port>

In the next major version we will be adding a flag to the CLI MSI install that will allow you to configure the deployment feature at install time, but for now it will have to be an extra step.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

gkanapathy
Splunk Employee
Splunk Employee

Please see this http://answers.splunk.com/questions/434/can-i-auto-install-or-deploy-splunk-onto-all-my-remote-windo... for best practices for mass installations on Windows.

Mick
Splunk Employee
Splunk Employee

ftk is correct, there's no way to specify the current_only flag with the CLI.

For a large scale implementation, deployment server is definitely the way you should be heading. With that in place, all you would need to do at installation time is just a vanilla install, and then the first time you start it up run the command to enable the deployment client. It will then go off and grab all the configs you need -

splunk set deploy-poll <IP address or hostname>:<port>

In the next major version we will be adding a flag to the CLI MSI install that will allow you to configure the deployment feature at install time, but for now it will have to be an extra step.

ftk
Motivator

This setting is not exposed via a command line switch. I recommend you use the LAUNCHSPLUNK=0 switch to not start splunk after installation, then edit your inputs.conf (or drop a standard one into place) to include the current_only setting, and then finally starting the splunk instance with the new config in place.

This can all be added to a simple batch script that can easily be farmed out to all your servers.

Alternatively I would look into using a deployment server to push out the configurations to your forwarders.

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...