Getting Data In

How can I install multiple instances of the universal forwarder?

pfabrizi
Path Finder

My team are the IS Security folks for the company. We are migrating to SPLUNK from McAfee Nitro and currently we only have a need to look at Windows security event logs. We have our business folks using their own deployment of SPLUNK and we don't want to piggy back or share the deployment as this now need to be managed by our operations team and slow down any upgrades we might want to do that business area wouldn't. For these reason we want our own deployment. I have tested running multiple instances on a device by installing, poking the registry to change the service name, zipping up the contents, exporting the registry key then play it back on another device. While this would work with old software deployment strategy it will not work with our new which is puppet.

I can install via puppet using the MSI and while I can deploy to a folder of my choosing the service is still installed as splunkuniversalforwader.

I am looking for suggestions on how I can implement this.

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Theres no way to set the service name using the MSI installer, so the only way is the registry hack you've already figured out.

http://docs.splunk.com/Documentation/Splunk/6.6.3/Installation/InstallonWindowsviathecommandline

You can import registry files with puppet though:

https://stackoverflow.com/questions/39544548/silent-way-to-import-registry-file-via-puppet-module

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Theres no way to set the service name using the MSI installer, so the only way is the registry hack you've already figured out.

http://docs.splunk.com/Documentation/Splunk/6.6.3/Installation/InstallonWindowsviathecommandline

You can import registry files with puppet though:

https://stackoverflow.com/questions/39544548/silent-way-to-import-registry-file-via-puppet-module

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...