@echo off
setlocal
REM Script to automate install of a splunk light forwarder on 64bit machines
REM ----------------------------------
REM Map install dir
NET USE T: \\ARRRGGG\SOFTWARE\Admin\Splunk

IF "%PROCESSOR_ARCHITECTURE%" == "AMD64" goto b64
IF "%PROCESSOR_ARCHITEW6432%" == "AMD64" goto b64
:b32
ECHO Detected 32 bit System
set MSI=T:\splunk-4.1.2-79191-x86-release.msi
goto install

:b64
ECHO Detected 64 bit System
set MSI=T:\splunk-4.1.2-79191-x64-release.msi

:install
REM Install splunk passively
ECHO Starting Splunk Install
msiexec /i "%MSI%" RBG_LOGON_INFO_USER_CONTEXT=1 LAUNCHSPLUNK=1 AUTOSTARTSERVICE_SPLUNKD=1 AUTOSTARTSERVICE_SPLUNKWEB=0 /passive

REM pause 10 sec
ping 1.1.1.1 -n 1 -w 10000 >NUL

"%PROGRAMFILES%\Splunk\bin\splunk" enable app SplunkLightForwarder -auth admin:changeme
"%PROGRAMFILES%\Splunk\bin\splunk" add forward-server SERVER:9997 -auth admin:changeme
"C:\Program Files\Splunk\bin\splunk.exe" set deploy-poll SERVER:8089 -auth admin:changeme
"%PROGRAMFILES%\Splunk\bin\splunk" edit user admin -password XXXXXXXXX -auth admin:changeme
"%PROGRAMFILES%\Splunk\bin\splunk" stop
REM install forwarder license
MOVE /Y "%PROGRAMFILES%\Splunk\etc\splunk-forwarder.license" "%PROGRAMFILES%\Splunk\etc\splunk.license"
REM "%PROGRAMFILES%\Splunk\bin\splunk" start


REM disable splunkweb
sc config Splunkweb start= disabled

REM unmount T:
NET USE T: /delete
REM pause
endlocal
exit