Getting Data In

AGREETOLICENSE not agreeing? Windows10

phongshader
New Member

I'm trying to install Splunk UF through an MDM onto windows 10 but i'm running into an issue with the AGREETOLICENSE flag...it does not agree. Running the command below on the command line exits immediately with no errors and no installation.
msiexec.exe /i C:\Windows\Temp\splunkforwarder-6.5.1-f74036626f0c-x64-release.msi RECEIVING_INDEXER="xxxxxxxxxx:xxxx" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 MONITOR_PATH=“C:\ProgramData\osquery\logs\osqueryd.results.log” AGREETOLICENSE=yes /quiet
When I remove the /quiet flag the UniversalForwarder Setup window opens and I have to "Check this box to accept the License Agreement" to continue and it does install.

I've tried stripping everything out of the command to msiexec.exe /i C:\Windows\Temp\splunkforwarder-6.5.1-f74036626f0c-x64-release.msi AGREETOLICENSE=yes with the same result, no agreement on the license. Any suggestions on how to trouble shoot this?

0 Karma

arizvi801
Explorer

Did anyone figure this out?

This is driving me insane in the mem-brain!  😫

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this works for us:

msiexec.exe /i <path to temp>/splunkforwarder-<XXXXX>-x64-release.msi AGREETOLICENSE=yes LAUNCHSPLUNK=no SERVICESTARTTYPE=auto /quiet /l*v install-log.txt

Then we are using separate app for configuring Deployment server stuff there, so we can change it later on if needed.

r. Ismo 

0 Karma

arizvi801
Explorer

Hey Brother,

Sorry, your option did not work, however, it did set me down the path where I figured out why.
The install.log portion was inspired!

Short version is that I had to amend your install with the following:

msiexec /i <splunkforwarderfile>.msi AGREETOLICENSE=1 LAUNCHSPLUNK=0 SERVICESTARTTYPE=auto /qb /l*v install.log

The "/qb" option did it for me.

isoutamo
SplunkTrust
SplunkTrust
In our case it's important to use the whole path for <splunkfowrarderfile>.msi. Without exact path (e.g. ./ or c:\temp\...) it couldn't find it and installation failed.
0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...