Splunk Enterprise

Where are the flags from the Universal forwarder located (config file)

splunk_luis12
Path Finder

Hi folks,

I'd like to know in which config file I can locate the flags from my universal forwarder.

I mean the flags like these: 

SERVICESTARTTYPE=auto and LAUNCHSPLUNK=1

Doc:  https://docs.splunk.com/Documentation/Forwarder/9.0.0/Forwarder/InstallaWindowsuniversalforwarderfro...

Thanks in advance,

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Those flags do not go in any config file.  They're command-line flags used with the Universal Forwarder installer.

msiexec.exe /i splunkuniversalforwarder_x86.msi DEPLOYMENT_SERVER="deploymentserver1:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet 

FWIW, the flags mentioned default to "auto" and "1", respectively, so they don't need to be specified.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

splunk_luis12
Path Finder

Very interesting information. I appreciate it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Those flags do not go in any config file.  They're command-line flags used with the Universal Forwarder installer.

msiexec.exe /i splunkuniversalforwarder_x86.msi DEPLOYMENT_SERVER="deploymentserver1:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet 

FWIW, the flags mentioned default to "auto" and "1", respectively, so they don't need to be specified.

---
If this reply helps you, Karma would be appreciated.

splunk_luis12
Path Finder

@drich Just a quick question: Can those flags be modified after the UF installation? Or how can I verify the current options of those flags?

Thanks in advance,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The LAUNCHSPLUNK flag tells the installer to start Splunk immediately after installation.  After that the flag doesn't apply so there's nothing to change.

The SERVICESTARTTYPE flag can be changed in the Windows Services app.  Open the app then scroll down to SplunkForwarderService.  Right-click on it and select Properties.  Then change the "Startup type" setting to the desired value.

The AGREETOLICENSE flag cannot be changed.

The INSTALLDIR flag can be changed only by re-installing the UF.

CLONEPREP, GENRANDOMPASSWORD, and SET_ADMIN_USER apply only at installation time.

Other flags can be changed via config files.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...