Is it safe to deploy the UF with these settings?
msiexec /i splunkforwarder64bit.msi
RECEIVING_INDEXER="servername:9997"
AGREETOLICENSE=Yes
DEPLOYMENT_SERVER="servername"
INSTALLDIR="C:\Program Files\Splunk"
LAUNCHSPLUNK=1
SERVICESTARTTYPE=auto
WINEVENTLOG_APP_ENABLE=1
WINEVENTLOG_SEC_ENABLE=1
WINEVENTLOG_SYS_ENABLE=1
/quiet
And then we just modify the UF once it is installed in the server and make changes depending on the server role (i.e. web server, domain controller, exchange, dmz, etc) so it will index the appropriate logs.
... View more