ufbuilder

ufbuilder is a series of utilities to simplify deploying Splunk Universal Forwarders.

Building a *nix Universal Forwarder

To build a *nix Universal Forwarder, first use nix/ufbuilder to construct a baseline package for your *nix forwarders.

This works with any *nix forwarder tar bundle.

./ufbuilder -h 
Build a Splunk UF Package for *nix Deployments.

Syntax: ufbuilder [-h] base_package deployserver

base_package  path to the Splunk provided base tar ball
deployserver  address and port of the deployment server
h             print help
b             build directory


./ufbuilder ~/splunkforwarder-<build>.tgz 10.1.1.1:8089

Next, use nix/packer to package a self-extracting shell script to install the forwarder.

./packer -h 
Build Splunk Universal Forwarder Installer

Syntax: installer [-h] splunk_package

splunk_package    a splunk UF package generated by ufbuilder
h                 print help

./packer splunkforwarder.tgz

Your installer file will be created at build/installer.

NOTE: It is very important that you do not modify your installer with a text editor. This file is automatically generated and parses itself. Because of this, it is fragile and must be regenerated with packer in order to avoid issues with the self-extracting installation.