Splunk
From DikapediaV2
the key command you will want to use to set up a universal forwarder to be a clean template on an VM image would be:
/opt/splunkforwarder/bin/splunk clone-prep-clear-config
There is also a seed.conf file that can be used.