Installing uberAgent

Installing uberAgent for Splunk is quick and straightforward. Due to the product’s flexibility, there is often more than one way of doing things. In such a case we describe the recommended configuration and link to supported alternatives.


  • Read about the architecture options.
  • If you do not have a running Splunk installation yet set up Splunk.
  • Download uberAgent and extract the archive. You should have a directory uberAgent components with the following content:
    • A subdirectory uberAgent_endpoint
    • Packed Splunk app uberAgent_indexer.tgz
    • Packed Splunk app uberAgent_searchhead.tgz

Installation Steps

Installing uberAgent consists of the following steps:

  1. Installing the Splunk apps
  2. Installing the endpoint agent
  3. Installing Universal Forwarder (optional)
  4. Installing the Chrome browser extension (optional)
  5. Installing the Internet Explorer Browser Extension (optional)