Hello! I'm trying to make the splunk forwarder part of my gold image template for windows servers. Right now, I have a script that installs the forwarder using vmware customization once the VM is cloned from it's template. I would instead like to install the forwarder on the gold image itself and get rid of the script. I am using directions from a splunk document. The 3rd section titled "Clone and restore the image" does not make sense to me, it seems to be saying clone the same image 2 or 3 times. Restart the machine and clone it with your favorite imaging utility. After cloning the image, use the imaging utility to restore it into another physical or virtual machine. Run the cloned image. Splunk services start automatically. Use the CLI to restart Splunk Enterprise to remove the cloneprep information: Step 1 - ok so I have cloned my gold image into another machine (that I would think can be used for prod) Step 2- Why do I need to restore the cloned VM to another machine? Step 3 - ok Step 4 - This is pretty inconvenient, this makes me have to either manually do something, or script it which I'm trying not to do. This may be terminology confusion on my part, but is there not a way to completely configure the forwarder on the gold image, and when I clone it using vmware, it just comes up and works? https://docs.splunk.com/Documentation/Splunk/8.2.4/Admin/Integrateauniversalforwarderontoasystemimage
... View more