A puppet module for managing splunk servers and forwarders.




9,083 latest version

2.0 quality score

Version information

  • 0.8.0 (latest)
  • 0.7.0
released Nov 11th 2013

Start using this module

Tags: splunk


mklauber/splunk — version 0.8.0 Nov 11th 2013


mklauber/splunk is a puppet module for installing and configuring the splunk Server and splunk Universal Forwarder.

It was created by Matthew Lauber. It is licensed under the Apache 2 License.

Build Status Build Status


Installation is done via the standard puppet module command. pupppet module install mklauber/splunk. Installation can also be done via placing a copy of the module in the /etc/puppet/modules/ directory.


Splunk Installation

The splunk server is installed with the following code: class { 'splunk::server': }. The splunk Universal Forwarder is installed with the following code: class { 'splunk::forwarder': }.

Input and Output Configuration

The Input and Output files for splunk Server and splunk Universal Forwarder are configured using Resource Definitions. These definitions can be placed in multiple classes, they will be concatenated and placed in the ${SPLUNK_HOME}/etc/system/local/ directory.


Default Input

This creates the [default] Stanza in the inputs.conf. It's always the first stanza if it's specified. It can only be specified once.

splunk::input::default { 'title': }

Monitor Input

Monitor input creates a [monitor://{path}] stanza for each path specified in path. Multiple monitors can be defined.

splunk::input::monitor { 'title':
  path => ['/path/to/log/files']

TCP Input

splunk::input::tcp { 'title':
  port => 9999


Syslog Output

splunk::output::syslog { 'title':
  server => 'syslog.example.com'

tcp Output

splunk::output::tcpout { 'title': }

tcpGroup Output

splunk::output::tcpGroup { 'title':
  target_group => 'Group Name'

tcpServer Output

splunk::output::tcpServer { 'title':
  ip_address => '',
  port       => 9999