Issue with Splunk Universal Forwarder blat.exe?

[maurobissante]

Hello! 

One of our customer has a problem with this executable "C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" that tries to launch this command

"C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" -install mailrelay2.domain.com [email protected] 

Can you help me to understand if this process is generated from Splunk or if it is a custom process?

Thank you,

Mauro

[John_Littleton]

Hi there,

Splunk UF, by default, doesn't create anything or operate outside of $SPLUNK_HOME, in this case C:\Program Files\SplunkUniversalForwarder\

Being this is outside of $SPLUNK_HOME, SplunkUniversalForwarder_script\ is likely a custom folder created by an individual. It looks like the download blat zip file contents were extracted into that folder. Not sure if they integrate at all, but they are certainly separate installs and not associated with each other by default.

--
If you found this helpful, give it a thumbs up for good Karma!