Deploy UniversalForwarder to Microsoft Intune

Published by Splunk in Monitoring

The universal forwarder collects data from a data source or another forwarder and sends it to a forwarder or a Splunk deployment. With a universal forwarder, you can send data to Splunk Enterprise, Splunk Light, or Splunk Cloud.

Publisher: Splunk
Homepage: Visit publisher website
License: Proprietary
Category: Monitoring

Deployment details

Latest version: 10.4.2
Installer type: msi
Install scope: machine
Silent install arguments: /qn /norestart AGREETOLICENSE=YES ALLUSERS=1
Install command: .\payload\Invoke-AppDeployToolkit.exe
Uninstall command: .\payload\Invoke-AppDeployToolkit.exe -DeploymentType Uninstall
Detection rule: The exact Intune detection rules generated for this PSADT package
App source: win32

Commands and arguments were captured during an automated QA install of version 10.4.2 in an isolated Windows VM.

Tested by IntuneGet QA

Passed

Version 10.4.2 tested on August 22, 2026.

VirusTotal scan of the installer hash: clean. 0 of 75 engines flagged it.

Recent versions

10.4.2
10.4.1
10.4.0
10.2.3
10.2.1
10.2.0

How deployment works

IntuneGet packages UniversalForwarder as a Win32 app and uploads it directly to your Microsoft Intune tenant. You review the package settings, configure assignments, and start the deployment from one guided workflow.