Splunk® Enterprise

Forwarding Data

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Remotely deploy a Windows universal forwarder with a static configuration

You typically deploy the universal forwarder with a static configuration for one of these reasons:

  • You don't need to change the configuration later - "fire-and-forget".
  • You'll be making any post-installation changes with a non-Splunk deployment tool such as System Center Configuration Manager, Altris, or BigFix/Tivoli.

For this type of deployment, you install via the Windows command line interface. During installation, you must specify all configuration options and use silent mode (/quiet). See "Deploy a Windows universal forwarder via the command line" for information on the command line interface, including a list of supported flags, including those that enable low-privilege operation.

Steps to deployment

Once you have downloaded the universal forwarder and have planned your deployment, as described in "Deployment overview", perform these steps:

1. Install and configure the universal forwarder on a test machine, using the command line interface with the desired flags.

2. Test and tune the deployment.

3. Load the universal forwarder MSI into your deployment tool, specifying the tested flags.

4. Execute deployment with your deployment tool.

5. Use the deployment monitor to verify that the universal forwarders are functioning.

Required installation flags

Besides specifying /quiet mode, you must include, at a minimum, these commandline flags:

  • RECEIVING_INDEXER="<server:port>"
  • At least one data input flag, such as WINEVENTLOG_APP_ENABLE=1. You can add as many data input flags as you need.

See "Deploy a Windows universal forwarder via the command line" for a list of all available command line flags.

Example installation

This example sets the universal forwarder to run as Local System user, get inputs from Windows security and system event logs, send data to indexer1, and launch automatically:

msiexec.exe /i splunkuniversalforwarder_x86.msi RECEIVING_INDEXER="indexer1:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /quiet

Deploy with a secure configuration

To deploy a secure configuration, you can specify an SSL certifcate. Use these installation flags:

  • CERTFILE=<c:\path\to\certfile.pem>
  • ROOTCACERTFILE=<c:\path\to\rootcacertfile.pem>
  • CERTPASSWORD=<password>

For more information, see this list of supported commandline flags.

Test the deployment

Test your configured universal forwarder on a single machine, to make sure it functions correctly, before deploying the universal forwarder across your environment. Confirm that the universal forwarder is getting the desired inputs and sending the right outputs to the indexer. You can use the deployment monitor to validate the universal forwarder.

Deploy a Windows universal forwarder via the command line
Make a universal forwarder part of a system image

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15


CopyCerts: Warning: Invalid property ignored: FailCA=.
CopyCerts: Info: Certificate file: 'C:\Users\Administrator\Desktop\splunk-forwarder\preparedServerCertificate.pem', root certificate file: 'C:\Users\Administrator\Desktop\splunk-forwarder\rootCACertificate.pem'.
CopyCerts: Error: Cannot copy certificate file: 'C:\Users\Administrator\Desktop\splunk-forwarder\preparedServerCertificate.pem'.
CopyCerts: Error 0x80004005: Cannot copy certificates.
CustomAction CopyCerts returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 17:58:15: InstallFinalize. Return value 3.

This is from install log - run msiexec with /log option

March 31, 2015

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters