Hello all,
I have a problem with which I am currently stuck.
Here is a short explanation.
For the automated installation of the Splunk Forwarder I wanted to perform a customized installation via GPO. Via Orca I have adapted the MSI file and added it to the extra GPO.
The goal is that new servers that join the domain install the forwarder directly at system startup. This works without any problems. The forwarder and the server are shown in the forwarder management. But I can't find the server in the search. It seems that the forwarder does not send any data to the Splunk Enterprise Server.
After comparing the server with a second working one I noticed that the inputs.conf is missing on the new server. For example, as soon as I copy it from a running server and change the corresponding hostname, the Enterprise Server receives data from the new server.
My question now is, why is the file not installed during setup? Is there any possibility that I forgot during the customization via Orca?
I thank you in advance for your answers.
