Splunk Enterprise

Where are the flags from the Universal forwarder located (config file)

splunk_luis12
Path Finder

Hi folks,

I'd like to know in which config file I can locate the flags from my universal forwarder.

I mean the flags like these: 

SERVICESTARTTYPE=auto and LAUNCHSPLUNK=1

Doc:  https://docs.splunk.com/Documentation/Forwarder/9.0.0/Forwarder/InstallaWindowsuniversalforwarderfro...

Thanks in advance,

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Those flags do not go in any config file.  They're command-line flags used with the Universal Forwarder installer.

msiexec.exe /i splunkuniversalforwarder_x86.msi DEPLOYMENT_SERVER="deploymentserver1:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet 

FWIW, the flags mentioned default to "auto" and "1", respectively, so they don't need to be specified.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

splunk_luis12
Path Finder

Very interesting information. I appreciate it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Those flags do not go in any config file.  They're command-line flags used with the Universal Forwarder installer.

msiexec.exe /i splunkuniversalforwarder_x86.msi DEPLOYMENT_SERVER="deploymentserver1:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet 

FWIW, the flags mentioned default to "auto" and "1", respectively, so they don't need to be specified.

---
If this reply helps you, Karma would be appreciated.

splunk_luis12
Path Finder

@Anonymous Just a quick question: Can those flags be modified after the UF installation? Or how can I verify the current options of those flags?

Thanks in advance,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The LAUNCHSPLUNK flag tells the installer to start Splunk immediately after installation.  After that the flag doesn't apply so there's nothing to change.

The SERVICESTARTTYPE flag can be changed in the Windows Services app.  Open the app then scroll down to SplunkForwarderService.  Right-click on it and select Properties.  Then change the "Startup type" setting to the desired value.

The AGREETOLICENSE flag cannot be changed.

The INSTALLDIR flag can be changed only by re-installing the UF.

CLONEPREP, GENRANDOMPASSWORD, and SET_ADMIN_USER apply only at installation time.

Other flags can be changed via config files.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...