Commandline installation for Splunk forwarder or light forwarder on Windows

This procedure gives some examples of how to install Splunk with the Splunk forwarder or light forwarder application pre-enabled via the commandline on Windows. You can do this silently (so that you can script it) or interactively. All the flags for installing Splunk for Windows via the commandline are described here.

Note: By default, Splunk enables the Splunk desktop application configuration when you install on Windows. You can change this by either specifying another application using the SPLUNK_APP flag, or by disabling the Splunk desktop application after you have completed the installation process.

Important: You MUST provide the forwarder/light forwarder with the hostname and port of the Splunk server to which it will send data, using the information in this topic. You must also use the same information to set the Splunk server that will be receiving the data as a receiver.

Note: If you are enabling a Splunk light forwarder, Splunk will start automatically when the installation process is completed. If you want Splunk to not start automatically, add

LAUNCHSPLUNK=0

to your installation string.
Important: If you are enabling the Splunk forwarder, Splunk will start automatically; this cannot be overridden.

Silent commandline install of Splunk light forwarder

This example installs Splunk via the MSI with the Splunk light forwarder application configuration enabled:

msiexec.exe /i Splunk.msi SPLUNK_APP="SplunkLightForwarder" FORWARD_SERVER="<server:port>" /quiet

where "<server:port>" are the server and port of the Splunk server to which this light forwarder will send data.

Commandline install of Splunk forwarder as the LocalSystem user

This example installs Splunk via the MSI to run as the LocalSystem user with the Splunk forwarder application configuration enabled:

msiexec.exe /i Splunk.msi SPLUNK_APP="SplunkForwarder"  FORWARD_SERVER="<server:port>" RBG_LOGON_INFO_USER_CONTEXT=1

where "<server:port>" are the server and port of the Splunk server to which this forwarder will send data.

Previous: Enable the Splunk forwarder or light forwarder | Next: Enable Splunk desktop configuration

Comments

No comments have been submitted.