To install the Splunk agent on a non-persistent VDI desktop running Windows, you can only perform the installation using the command line.

To install the Splunk Universal Forwarder without launching the service immediately, you need to use the “LAUNCHSPLUNK=0” parameter and value.

Here’s an example command for the installation:

msiexec.exe /i splunkuniversalforwarder_x86.msi DEPLOYMENT_SERVER="deploymentserver1:8089" LAUNCHSPLUNK=0 AGREETOLICENSE=Yes /quiet

One installation is done, please check windows services and make sure the service is not running.

If your Windows image requires additional tasks, you may set the service startup type to Manual mode. However, remember to change it back to Automatic before finalizing the image for the VDI desktop pool.

Also, make sure to stop the service before executing the following command from PowerShell to finalize or seal the image for the VDI:

1. Make sure the SplunkForwarder Service is stopped
2. From Powershell go to Bin folder under Splunk Universal Forwarder installation folder
3. Run ./splunk clone-prep-clear-config to clear the existing entries from the VM

Once the existing configuration is cleared, complete any pending tasks to finalize the image before shutting it down and taking a snapshot of the image for the desktop pool.