Splunk® Enterprise

Admin Manual

Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Integrate a universal forwarder onto a system image

This topic discusses the procedure to integrate a Splunk universal forwarder into a Windows system image. For additional information about integrating Splunk Enterprise into images, see Integrate Splunk Enterprise into system images.

Install and configure Windows and applications

  1. On a reference computer, install and configure Windows the way that you want, including installing Windows features, service packs, and other components.
  2. Install and configure necessary applications, taking into account Splunk's system and hardware capacity requirements.
  3. Install and configure the universal forwarder from the command line. You must supply at least the LAUNCHSPLUNK=0 command line flag when you perform the installation.
  4. Proceed through the graphical portion of the install, selecting the inputs, deployment servers, and/or forwarder destinations you want.
  5. After the installation has completed, open a command prompt or PowerShell window.

Edit configurations and run clone-prep-clear-config

  1. (Optional) Edit configuration files that were not configurable in the installer.
  2. Change to the universal forwarder bin directory.
  3. Run ./splunk clone-prep-clear-config.
  4. Exit the command prompt or PowerShell window.
  5. In the Services Control Panel, configure the splunkd service to start automatically by setting its startup type to 'Automatic'.
  6. Prepare the system image for domain participation using a utility such as Windows System Image Manager (WSIM). Microsoft recommends using SYSPREP or WSIM as the method to change machine Security Identifiers (SIDs) prior to cloning, as opposed to using third-party tools (such as Ghost Walker or NTSID.)

Clone and restore the image

  1. Restart the machine and clone it with your favorite imaging utility.
  2. After cloning the image, use the imaging utility to restore it into another physical or virtual machine.
  3. Run the cloned image. Splunk services start automatically.
  4. Use the CLI to restart Splunk Enterprise to remove the cloneprep information:

    splunk restart

    You must restart Splunk Enterprise from the CLI to delete the cloneprep file. Restarting the Splunk service does not perform the deletion.

  5. Confirm that the $SPLUNK_HOME\cloneprep file has been deleted.

The image is now ready for deployment.

Last modified on 29 March, 2022
Put Splunk Enterprise onto system images   Integrate an installation of Splunk Enterprise onto a system image

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters