How to specify an index when deploying the Splunk Universal Forwarder on a Windows domain?

[DashZentin]

I plan to deploy the Splunk UF across all my Windows client PCs using SCCM. But I'm confused about the index settings. I want to send all the data to a specific index but when the UF installs it just defaults to the main index.

Is there a way to specify the index during installation? As I don't want data going to main before I change it.

[Wander]

This is super easy to do, but you'll need to have your apps setup right on the deployment server. There You would create an app that has the index location, and the then the right inputs.conf containing the stanzas to pull the windows info and then what index it should go to. 

How you structure the apps is up to you. The important piece is getting then setup on the deployment server.

The when you install the UF on the windows hosts, use SCCM and only give the msiexec installer command  the address of the deployment server. Don't put in an indexer here. 

When the agent loads, the hosts will check into the deployment server, pull the right apps, provided you've got it set right, and all your data will got where you want it out of the gate and not hit main.

[livehybrid]

Hi @DashZentin 

You cannot change the index used for the Windows inputs as part of the installation process, however you could run the MSI with 'LAUNCHSPLUNK=0' and then modify the inputs.conf once the package is installed before then starting the Splunk forwarder service to complete the installation.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing