Install Splunk without logging in

[WillBee]

I am the first contact to Splunk for my company; I am brand new at all this but am excited to learn more about Splunk.  

To save coworkers (or in the future, new employees), I wonder if it is possible to perform the installation of Splunk on a computer without logging in.  This way, I'm thinking that this could be added to the initial set-up of a computer for any employee.  Then, when they go to Splunk the first time, the install is done and all they need to do is log in.  So far when I try to just go to the website, it wants an ID and password before letting me install.  

I tried saving the *msi file on my OneDrive and sharing it with the new system.  That part worked, but after starting the *msi file to begin installation, it wants the sign-in info right at the start.

Is there a way around that?  Sure, sure; I know the installation is easy and does not take that long, but anything I can do from the Admin side to streamline the process, the better.

Thank you for any response

[asimit]

Yes, you can definitely automate Splunk installation without user interaction. The login prompt you are seeing isn't for Splunk.com, it is asking you to create a local admin account for that Splunk instance.

Once you've downloaded the MSI file from Splunk.com (one-time login required), you can deploy it silently using below command-line parameters. The basic command looks like this:

msiexec.exe /i splunk.msi AGREETOLICENSE=Yes SPLUNKUSERNAME=admin SPLUNKPASSWORD=YourPassword123! /quiet

Splunk Doc that you can refer: https://help.splunk.com/en/splunk-enterprise/forward-and-process-data/universal-forwarder-manual/9.4... 

The key is using AGREETOLICENSE=Yes and setting SPLUNKPASSWORD to skip the interactive setup. You can push this via Group Policy, SCCM, or even a PowerShell script to automate deployments across multiple computers. This way, the installation completes silently in the background, and employees just need to open Splunk and log in with the credentials you've set. You might also want to use INSTALLDIR="C:\Splunk" to avoid path length issues with the default Program Files location. For ongoing management, Splunk's deployment server can handle configuration updates after the initial install.

I hope this will fit your requirement.

Please give 👍 for support 😁 happly splunking .... 😎

[WillBee]

Ok; thank you.  Based on the rest of this thread, I think I have a-ways to go before I get there.

[richgalloway]

Why are you installing Splunk on every Windows system?  It should be installed on a central server and accessed via web browser.

Perhaps you're referring to the Splunk Universal Forwarder.  That should indeed be installed on each machine, but do it as part of the system image.  If that's not possible then I know customers have installed it using GPO.

To prevent Splunk from asking for credentials, supply them when launching the installation.  See the installation manual.

[WillBee]

Hi Rich,

I'm sure I'm using the wrong/imprecise term.  I meant to refer to the Splunk Enterprise app--that I think is installed -- then run on a browser -- and has the various apps on the left side Apps panel, including (at the least) the Home app and Search & Reporting app.

And to show what a newbie I am, I thought the forwarders were on the servers, forwarding the data from the server to the Enterprise/user side of Splunk.  Clearly, I have a lot more to learn.

Yes, I was thinking that the user side of Splunk would be put into the image, but still there is the issue of getting it installed there without an account.  This might not be worth the effort; I may just have folks execute the installation themselves.  It's less than 10 minutes so not a disaster if they do it themselves.

Thank you for your quick reply. 

Will B

[richgalloway]

Thanks for clarifying.

While Splunk Enterprise can be installed on Windows workstations, that's typically done for dev/test purposes.  Workstations don't have the horsepower to handle enterprise quantities of data.

The typical model is to install SE on shared servers (on-prem or virtual) with all other enterprise devices running a Universal Forwarder to send data to SE.

[WillBee]

That's good to know.  I will have to look into doing that.