Splunk

the key command you will want to use to set up a universal forwarder to be a clean template on an VM image would be:

/opt/splunkforwarder/bin/splunk clone-prep-clear-config

There is also a seed.conf file that can be used.