How to specify an index when deploying the Splunk Universal Forwarder on a Windows domain?

[DashZentin]

I plan to deploy the Splunk UF across all my Windows client PCs using SCCM. But I'm confused about the index settings. I want to send all the data to a specific index but when the UF installs it just defaults to the main index.

Is there a way to specify the index during installation? As I don't want data going to main before I change it.

[livehybrid]

Hi @DashZentin 

You cannot change the index used for the Windows inputs as part of the installation process, however you could run the MSI with 'LAUNCHSPLUNK=0' and then modify the inputs.conf once the package is installed before then starting the Splunk forwarder service to complete the installation.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing