Installation

How to deploy a Windows universal forwarder via the command line?

Mark_Barrett
Explorer

I'm trying to make a batch file to install Universal Forwarder on our servers. The batch file is able to get the .MSI file to launch, but it seems to ignore all the flags and it acts the same as I were to double-click on the .MSI for manual installation. The first thing I see is the install program asking me to click Next, and then it asks to Agree to the license - even though I specifically included the flag to have this done automatically.
I've already successfully run a manual install on another server which is nearly identical to this one. The account being used to run the install has full Admin rights to the box, so there shouldn't be any rights issues.
Here is my batch file command:
msiexec.exe /i splunkforwarder-4.3.4-136012-x64-release.msi AGREETOLICENSE=Yes RECEIVING_INDEXER="serverxxx" LAUNCHSPLUNK=1 WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1

Labels (2)
0 Karma

dheinz
New Member

I'm attempting to install the msi via batch file using the following and it just opens the command line switch box??

msiexec.exe /i splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi AGREETOLICENSE=Yes LOGON_USERNAME=”MYDOMAIN\splunkagent” LOGON_PASSWORD="password” DEPLOYMENT_SERVER="00.00.000.00:0000” LAUNCHSPLUNK=1

0 Karma

neklov_splunk
Splunk Employee
Splunk Employee

Hi,
I think you have forgot the quiet flag, look at this example:
msiexec.exe /i splunkuniversalforwarder_x86.msi RECEIVING_INDEXER="indexer1:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /quiet
The quiet flag will enable an unattended installation of the MSI package.

Mark_Barrett
Explorer

Actually I tried the /QUIET flag first (before submitting this question without /quiet).
With /QUIET the install starts/ends in less than 1 second, no files/folders created locally and no new services started.

dheinz
New Member

I'm attempting to install the msi via batch file using the following and it just opens the command line switch box??

msiexec.exe /i splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi AGREETOLICENSE=Yes LOGON_USERNAME=”MYDOMAIN\splunkagent” LOGON_PASSWORD="password” DEPLOYMENT_SERVER="00.00.000.00:0000” LAUNCHSPLUNK=1

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...