Deploy UniversalForwarder to Microsoft Intune

Published by Splunk in Monitoring

The universal forwarder collects data from a data source or another forwarder and sends it to a forwarder or a Splunk deployment. With a universal forwarder, you can send data to Splunk Enterprise, Splunk Light, or Splunk Cloud.

Publisher: Splunk
Homepage: Visit publisher website
License: Proprietary
Category: Monitoring

Deployment details

Latest version: 10.6.1.1
Installer type: msi
Install scope: machine
Silent install arguments: /qn /norestart AGREETOLICENSE=YES ALLUSERS=1
Install command: .\payload\Invoke-AppDeployToolkit.exe
Uninstall command: .\payload\Invoke-AppDeployToolkit.exe -DeploymentType Uninstall
Detection rule: The exact Intune detection rules generated for this PSADT package
App source: win32

Commands and arguments were captured during an automated QA install of version 10.6.1.1 in an isolated Windows VM.

Tested by IntuneGet QA

Passed

Version 10.6.1.1 tested on October 16, 2026.

VirusTotal scan of the installer hash: clean. 0 of 54 engines flagged it.

Package provenance

Installer source: download.splunk.com
Installer SHA-256: 3A42233E387DC28D9E9ECC4C9DC41F184A006862762AA9213F7CD3CC97145A03Check on VirusTotal
PSADT version: 4.1.8
Packaging commit: 1cc5fb513c
Package profile: 87E74F59B8B36B30...

IntuneGet verifies the installer SHA-256 before packaging and does not store the installer. The full evidence, including the recorded hash, is in the QA report.

Recent versions

10.6.1.1
10.6.0.5
10.4.4
10.4.3
10.2.3

How deployment works

IntuneGet packages UniversalForwarder as a Win32 app and uploads it directly to your Microsoft Intune tenant. You review the package settings, configure assignments, and start the deployment from one guided workflow.