Splunk Search

Anyone know of an efficient method to deploy Splunk UF v6.3.3 with Splunk_TA_Windows to several hundred Windows 2012 Servers?

jl_Splunk
Engager

Hello All,

Does anyone know of an efficient method to deploy Splunk UF v6.3.3 with Splunk_TA_Windows to several hundred Windows 2012 Servers? I've search the web but there were nothing about 2012 servers and Splunk UF v6.3.3 with Splunk_TA_Windows.

Thanks!

0 Karma
1 Solution

javiergn
Super Champion

I would use a Deployment Server for that as follows:

  • Install and configure a deployment server to deploy the Splunk_TA_Windows or any other app to your hosts. Documentation here
  • Download latest UF msi installer
  • Either use PowerShell, SCCM, psexec, or whatever other deployment solution you want to remotely run msi packages
  • Install the universal forwarder to run as the Local System user and request configuration from deploymentserver1, automatically agree to license and install in silent mode

    msiexec.exe /i splunkuniversalforwarder_x86.msi DEPLOYMENT_SERVER="deploymentserver1:8089" AGREETOLICENSE=Yes /quiet

  • If you want to use a domain user the syntax is different. More info here

  • Your UF will contact the deployment server and download any app made available to it based on your whitelist and blacklist configurations in your serverclass.conf

Hope that helps,
J

View solution in original post

javiergn
Super Champion

I would use a Deployment Server for that as follows:

  • Install and configure a deployment server to deploy the Splunk_TA_Windows or any other app to your hosts. Documentation here
  • Download latest UF msi installer
  • Either use PowerShell, SCCM, psexec, or whatever other deployment solution you want to remotely run msi packages
  • Install the universal forwarder to run as the Local System user and request configuration from deploymentserver1, automatically agree to license and install in silent mode

    msiexec.exe /i splunkuniversalforwarder_x86.msi DEPLOYMENT_SERVER="deploymentserver1:8089" AGREETOLICENSE=Yes /quiet

  • If you want to use a domain user the syntax is different. More info here

  • Your UF will contact the deployment server and download any app made available to it based on your whitelist and blacklist configurations in your serverclass.conf

Hope that helps,
J

jl_Splunk
Engager

Thank you J. This helped and worked.

This was our command using (psexec):
msiexec.exe /i splunkforwarder-6.3.3-f44afce176d0-x64-release.msi DEPLOYMENT_SERVER="deployerip:8089" RECEIVING_INDEXER="indexerhostname.com:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /quiet

We were also able to enable winevent at the same time.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...