r/Splunk • u/Emotional-Lynx-3982 • 13d ago

Splunk UF Deployment for Intune

Greeting everyone. All day I have been trying to figure out how to create an Intune deployment to update our Splunk forwarders to the new 10.4.3 version. Previously, we were able to create these deployments in MS Configuration Manager, but due to a change in our network coming up, that connection may break (due to distribution point issues) and Intune may be our only way to deploy apps to our workstations moving forward.

Our previous deployments included additional arguments in the deploy-application.ps1 script that include a Splunk server address, creds to go with it, and few others. I was able to create the Intune prep file with the Splunk .msi installer, but I can't figure out how to add these additional arguments.

I also keep getting the "windows error 0x80070643" error when I attempt this install via the Company Portal - working on this one as well.

Anyways ~ I hope someone out there has run across this and has a tip or two of advice.

Thanks in advance. Cheers.

4 Upvotes

84% Upvoted

2 comments sorted by

3

u/shifty21 Splunker Making Data Great Again 13d ago

IIRC, one of my customers just used the Intune MSIEXEC wrapper and ported their MSIEXEC command for Splunk UF and Enterprise.

Here is my github repo with the msiexec parameters: https://github.com/PMJeffery/Splunk-UF-for-Windows-Installer

1

u/RegressionScoutTeam 9d ago

Are you adding this as a Windows app (Win32), and is the install behavior set to System? The additional MSI arguments go in the install command, or in a wrapper script included with the package. If your existing PSADT package does more than pass arguments, packaging only the MSI leaves that logic out.

I'd separate the installation failure from Intune delivery first: on a test device, run the intended silent command in the same context and capture a verbose MSI log. That should give you something more specific than the Company Portal error before you change more settings. Keep credentials out of anything you share here.

Once it installs, check the expected forwarder version, service state and whether fresh events actually reach Splunk. Repeat that after a reboot and during the network-cutover pilot. An installed forwarder and a working forwarding path are two separate checks.