Based on the splunk documentation, I'm guessing it's recommended to script customized installation requirements rather than trying to generate a custom RPM. I'd like some feedback on that. If customizing RPM's is doable can you post a spec file for 4.2. I am aware there are spec files for older versions on the net, I'm specifically trying to work with 4.2. TIA.
Our solution to this was to make our own rpm that is dependent upon the splunkforwarder RPM. Our RPM ships the appropriate config files to get a forwarder properly configured and talking to a deployment server.
Our RPM contains (relative to /opt/splunkforwarder)