How to install a new environment with FIPS enabled before the initial startup?

[cboillot]

We are looking into installing new environment. In this environment, we are wanting to have FIPS enabled. Instructions state that we need to do this "before initial startup."

My question is this: How would we go about doing this? My first thought would be that installing via command line would work, as it does state "[y]ou want to install Splunk Enterprise, but do not want it to start right away". However, the flag that I would think would do this, LAUNCHSPLUNK=0/1, states start up automatically on system boot.

Am I understanding this correctly? How would I go about doing this?

[damiensurat · Accepted solution]

This comes from a previously answered question to the topic from this splunk answers post, but still apply's to the latest version of Splunk:
https://answers.splunk.com/answers/6383/can-i-configure-the-windows-installer-to-not-start-splunk-ri...

Passing the "LAUNCHSPLUNK=0" argument to the Splunk MSI installer with msiexec will prevent splunkd and splunkweb from starting automatically.

Example for a Splunk 4.1.4 x86 installer :

C:\Downloads> msiexec /i splunk-4.1.4-82143-x86-release.msi LAUNCHSPLUNK=0
Note that this will also configure both services for a manual startup, so make sure you change that afterward if that's not the desired setting.

More flags that can be passed to the Splunk Windows installer to automate your deployment can be found in the web documentation :

http://www.splunk.com/base/Documentation/latest/Installation/InstallonWindowsviathecommandline#Suppo...

The following Splunk Answer, which covers the topic of automated large-scale deployment in a Windows environment, deserves to be pointed out here as suggested further reading : http://answers.splunk.com/questions/434/can-i-auto-install-or-deploy-splunk-onto-all-my-remote-windo...

Please note that you must not enable any app during install, i.e., SPLUNK_APP="" must also be provided. Otherwise, the LAUNCHSPLUNK=0 flag will be ignored. The default SPLUNK_APP setting varies from version to version, so it is safest to specify SPLUNK_APP=""

[cboillot]

Thanks! Just wanted to make sure as the flag purpose only refers to system boot, and not after install.

[damiensurat]

Yeah, my pleasure. And get this, Azure is handing out free cloud:
https://azure.microsoft.com/

I typically spin up a free vm there and test any solutions before trying in my own environment ;)..

Happy Splunking!