This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12
This procedure gives some examples of how to install Splunk with the Splunk forwarder or light forwarder application pre-enabled via the commandline on Windows. You can do this silently (so that you can script it) or interactively. All the flags for installing Splunk for Windows via the commandline are described in this Windows installation topic.
Note: By default, Splunk enables the Splunk desktop application configuration when you install on Windows. You can change this by either specifying another application using the SPLUNK_APP flag, or by via Splunk Web disabling the Splunk desktop application after you have completed the installation process.
Important: You MUST provide the forwarder/light forwarder with the hostname and port of the Splunk server to which it will send data, using the information in this topic. You must also use the same information to set the Splunk server that will be receiving the data as a receiver.
Note: If you are enabling a Splunk light forwarder, Splunk will start automatically when the installation process is completed. If you want Splunk to not start automatically, add
LAUNCHSPLUNK=0
to your installation string.
Important: If you are enabling the Splunk forwarder, Splunk will start automatically; this cannot be overridden.
This example installs Splunk via the MSI with the Splunk light forwarder application configuration enabled:
msiexec.exe /i Splunk.msi SPLUNK_APP="SplunkLightForwarder" FORWARD_SERVER="<server:port>" /quiet
where "<server:port>" are the server and port of the Splunk server to which this light forwarder will send data.
This example installs Splunk via the MSI to run as the LocalSystem user with the Splunk forwarder application configuration enabled:
msiexec.exe /i Splunk.msi SPLUNK_APP="SplunkForwarder" FORWARD_SERVER="<server:port>" RBG_LOGON_INFO_USER_CONTEXT=1
where "<server:port>" are the server and port of the Splunk server to which this forwarder will send data.