http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/DeployaWindowsdfviathecommandline
I am installing the Universal Forwarder using SCCM and was wondering if there was a flag available for the index name. I am able to add everything else except for the index name using CLI flags. If not, is there another simple way to add it during silent installation?
If you are not using Deployment Server to manage your forwarders http://docs.splunk.com/Documentation/Splunk/6.0.2/Updating/Aboutdeploymentserver
Then, you should create an inputs.conf (which specifies the index you want) that gets sent down with the UF
http://docs.splunk.com/Documentation/Storm/Storm/User/SetupauniversalforwarderonWindows
Setup the inputs.conf to monitor the files you are interested in.
http://docs.splunk.com/Documentation/Storm/Storm/User/Editinputsconf
But if you have a big deployment of UF then you probably really should check out Deployment Server to manage your forwarder configurations.
If you are not using Deployment Server to manage your forwarders http://docs.splunk.com/Documentation/Splunk/6.0.2/Updating/Aboutdeploymentserver
Then, you should create an inputs.conf (which specifies the index you want) that gets sent down with the UF
http://docs.splunk.com/Documentation/Storm/Storm/User/SetupauniversalforwarderonWindows
Setup the inputs.conf to monitor the files you are interested in.
http://docs.splunk.com/Documentation/Storm/Storm/User/Editinputsconf
But if you have a big deployment of UF then you probably really should check out Deployment Server to manage your forwarder configurations.
So it sounds like there is no flag that can be set during installation. I've worked around the problem for now by inserting the information via script.
Eventually, we will use the deployment server, but don't have it set up yet.