Where are the flags from the Universal forwarder located (config file)

[splunk_luis12]

Hi folks,

I'd like to know in which config file I can locate the flags from my universal forwarder.

I mean the flags like these: 

SERVICESTARTTYPE=auto and LAUNCHSPLUNK=1

Doc:  https://docs.splunk.com/Documentation/Forwarder/9.0.0/Forwarder/InstallaWindowsuniversalforwarderfro...

Thanks in advance,

[splunk_luis12]

Very interesting information. I appreciate it.

[richgalloway · Accepted solution]

Those flags do not go in any config file.  They're command-line flags used with the Universal Forwarder installer.

msiexec.exe /i splunkuniversalforwarder_x86.msi DEPLOYMENT_SERVER="deploymentserver1:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet 

FWIW, the flags mentioned default to "auto" and "1", respectively, so they don't need to be specified.

[splunk_luis12]

@Anonymous Just a quick question: Can those flags be modified after the UF installation? Or how can I verify the current options of those flags?

Thanks in advance,

[richgalloway]

The LAUNCHSPLUNK flag tells the installer to start Splunk immediately after installation.  After that the flag doesn't apply so there's nothing to change.

The SERVICESTARTTYPE flag can be changed in the Windows Services app.  Open the app then scroll down to SplunkForwarderService.  Right-click on it and select Properties.  Then change the "Startup type" setting to the desired value.

The AGREETOLICENSE flag cannot be changed.

The INSTALLDIR flag can be changed only by re-installing the UF.

CLONEPREP, GENRANDOMPASSWORD, and SET_ADMIN_USER apply only at installation time.

Other flags can be changed via config files.