Getting Data In

How can I install multiple instances of the universal forwarder?

pfabrizi
Path Finder

My team are the IS Security folks for the company. We are migrating to SPLUNK from McAfee Nitro and currently we only have a need to look at Windows security event logs. We have our business folks using their own deployment of SPLUNK and we don't want to piggy back or share the deployment as this now need to be managed by our operations team and slow down any upgrades we might want to do that business area wouldn't. For these reason we want our own deployment. I have tested running multiple instances on a device by installing, poking the registry to change the service name, zipping up the contents, exporting the registry key then play it back on another device. While this would work with old software deployment strategy it will not work with our new which is puppet.

I can install via puppet using the MSI and while I can deploy to a folder of my choosing the service is still installed as splunkuniversalforwader.

I am looking for suggestions on how I can implement this.

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Theres no way to set the service name using the MSI installer, so the only way is the registry hack you've already figured out.

http://docs.splunk.com/Documentation/Splunk/6.6.3/Installation/InstallonWindowsviathecommandline

You can import registry files with puppet though:

https://stackoverflow.com/questions/39544548/silent-way-to-import-registry-file-via-puppet-module

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Theres no way to set the service name using the MSI installer, so the only way is the registry hack you've already figured out.

http://docs.splunk.com/Documentation/Splunk/6.6.3/Installation/InstallonWindowsviathecommandline

You can import registry files with puppet though:

https://stackoverflow.com/questions/39544548/silent-way-to-import-registry-file-via-puppet-module

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!