I'm running this command in Powershell to try to install a Universal Forwarder on my windows 2019 server    msiexec.exe /i "C:\TEMP\splunkforwarder-9.0.0.1-9e907cedecb1-x64-release.msi" WINEVENTLOG_APP_ENABLE=0 WINEVENTLOG_SEC_ENABLE=0 WINEVENTLOG_SYS_ENABLE=0 WINEVENTLOG_FWD_ENABLE=0 WINEVENTLOG_SET_ENABLE=0 AGREETOLICENSE=Yes SERVICESTARTTYPE=auto DEPLOYMENT_SERVER="deployment.splunk.uic.edu:8089" /norestart   I'm running into this error and not sure why:   This isntallation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a Valid windows installer package.     Is there a better way to install the universal forwarder over the command line? ... View more

I have the Service Now add-on for Splunk installed and I'm referencing this document for configuring  ServiceNow as a trigger action. Here's a screenshot from the doc for reference:   My question is, can steps 7 and 8 be done via the Splunk the API? I have about 100 alerts and what I'd like to do is perform steps 7 and 8 programmatically (Where I create a trigger action that uses ServiceNow Incident Integration and populates some of the values) ... View more

I'm using Ansible to try to configure SPlunk Enterprise and more specifically- I want to create a user for the Splunk add-on TA-jira-service-desk-simple-addon However, I'm getting this error when trying when trying to run my Ansible  "Status code was -1 and not [200]: Connection failure: [Errno 104] Connection reset by peer"   Is this because I'm using a free-trial for Splunk? I deployed Splunk using the Splunk Enterprise API on AWS and I can connect to Splunk web no problem. Here's my Ansible playbook: --- - name: Create Jira Service Desk User in Splunk hosts: splunk_sh gather_facts: false tasks: - name: Create user uri: url: "http://ec2-44-212-47-250.compute-1.amazonaws.com:8089/servicesNS/nobody/TA-jira-service-desk-simple-addon/ta_service_desk_simple_addon_account" method: POST user: "admin username" password: "admin password" body: "name=svc_jira&jira_url=test.url.com&username=test_username" status_code: 200 I redacted my admin username and password, but I tried using the URL above (Which is the DNS name) and I tried using just the IPv4 address with port 8089 and the endpoint and it gave me the same error. I made sure that port 8089 is also open on my AWS Security Group. What could be causing the issues? ... View more