Puppet Module For Splunk

Table of Contents

1. Overview
2. Module Description - What the module does and why it is useful
3. Setup - The basics of getting started with splunk
   • What splunk affects
   • Setup requirements
   • Beginning with splunk
4. Usage - Configuration options and additional functionality
   • Upgrade splunk/splunkforwarder packages
     • Upgrade Example
5. Reference - An under-the-hood peek at what the module is doing and how
6. Limitations - OS compatibility, etc.
7. Development - Guide for contributing to the module

Overview

This module provides a method to deploy Splunk Enterprise or Splunk Universal Forwarder with common configurations and ensure the services maintain a running state. It provides types/providers to interact with the various Splunk/Forwarder configuration files.

Module Description

This module does not configure firewall rules. Firewall rules will need to be configured separately in order to allow for correct operation of Splunk and the Splunk Universal Forwarder.

Setup

What splunk affects

• Installs the Splunk/Forwarder package and manages their config files. It does not purge them by default.
• The module will set up both Splunk Enterprise and Splunk Forwarder to run as the 'root' user on POSIX platforms.
• By default, enables Splunk Enterprise and Splunk Forwarder boot-start, and uses the vendor-generated service file to manage the splunk service.

Setup Requirements

To begin using this module, use the Puppet Module Tool (PMT) from the command line to install this module:

puppet module install puppet-splunk

This will place the module into your primary module path if you do not utilize the --target-dir directive.

You can also use r10k or code-manager to deploy the module so ensure that you have the correct entry in your Puppetfile.

By default, this module will download the installation packages from https://download.splunk.com.

You can also configure offline installers, there is just a little setup needed.

First, you will need to place your downloaded splunk installers into the files directory, <module_path>/splunk/files/. If you're using r10k or code-manager you'll need to override the splunk::params::src_root parameter to point at a modulepath outside of the Splunk module because each deploy will overwrite the files.

The files must be placed according to directory structure example given below.

The expected directory structure is:

 $root_url/
 └── products/
     ├── universalforwarder/
     │   └── releases/
     |       └── $version/
     |           └── $platform/
     |               └── splunkforwarder-${version}-${build}-${additl}
     └── splunk/
         └── releases/
             └── $version/
                 └── $platform/
                     └── splunk-${version}-${build}-${additl}

A semi-populated example files directory might then contain:

$root_url/
└── products/
    ├── universalforwarder/
    │   └── releases/
    |       └── 9.2.0/
    |           ├── linux/
    |           |   ├── splunkforwarder-9.2.0-1fff88043d5f-linux-2.6-amd64.deb
    |           |   ├── splunkforwarder-9.2.0-1fff88043d5f-linux-2.6-intel.deb
    |           |   └── splunkforwarder-9.2.0-1fff88043d5f.x86_64.rpm
    |           ├── solaris/
    |           └── windows/
    |               └── splunkforwarder-9.2.0-1fff88043d5f-x64-release.msi
    └── splunk/
        └── releases/
            └── 9.2.0/
                └── linux/
                    ├── splunk-9.2.0-1fff88043d5f-linux-2.6-amd64.deb
                    ├── splunk-9.2.0-1fff88043d5f-linux-2.6-intel.deb
                    └── splunk-9.2.0-1fff88043d5f.x86_64.rpm

Second, you will need to supply the splunk::params class with three critical pieces of information.

• The version of Splunk you are using
• The build of Splunk you are using
• The root URL to use to retrieve the packages

In the example given above, the version is 9.2.0, the build is 1fff88043d5f, and the root URL is puppet:///modules/splunk. See the splunk::params class documentation for more information.

Beginning with splunk

Once the Splunk packages are hosted in the users repository or hosted by the Puppet Server in the modulepath the module is ready to deploy.

Usage

If a user is installing Splunk Enterprise with packages provided from their modulepath, this is the most basic way of installing Splunk Server with default settings:

include splunk::enterprise

This is the most basic way of installing the Splunk Universal Forwarder with default settings:

class { 'splunk::params':
    server => $my_splunk_server,
}

include splunk::forwarder

Once both Splunk Enterprise and Splunk Universal Forwarder have been deployed on their respective nodes, the Forwarder is ready to start sending logs.

In order to start sending some log data, users can take advantage of the Splunkforwarder_input type. Here is a basic example of adding an input to start sending Puppet Server logs:

@splunkforwarder_input { 'puppetserver-sourcetype':
  section => 'monitor:///var/log/puppetlabs/puppetserver/puppetserver.log',
  setting => 'sourcetype',
  value   => 'puppetserver',
  tag     => 'splunk_forwarder'
}

This virtual resource will get collected by the ::splunk::forwarder class if it is tagged with splunk_forwarder and will add the appropriate setting to the inputs.conf file and refresh the service.

Setting the admin user's password

The module has the facility to set Splunk Enterprise's admin password at installation time by leveraging the user-seed.conf method described as a best practice in the Splunk docs. The way Splunk implements this prevents Puppet from managing the password in an idempotent way but makes resetting the password through the web console possible. You can also use Puppet to do a one time reset too by setting the appropriate parameters on splunk::enterprise but leaving these parameters set to true will cause corrective change on each run of the Puppet Agent.

class { 'splunk::enterprise':
  seed_password    => true,
  password_hash    => '$6$jxSX7ra2SNzeJbYE$J95eTTMJjFr/lBoGYvuJUSNKvR7befnBwZUOvr/ky86QGqDXwEwdbgPMfCxW1/PuB/IkC94QLNravkABBkVkV1',
}

Alternatively the splunk::enterprise::password::seed class can be used independently of the Puppet Agent through a Bolt Plan apply block.

Upgrade splunk and splunkforwarder packages

This module has the ability to install and upgrade the splunk and splunkforwarder packages. All you have to do is declare package_ensure => 'latest' when calling the ::splunk or ::splunk::forwarder classes.

Upgrade Example

The following code will install the 9.1.0 version of the splunk forwarder. Then comment out the 9.1.0 version and build values and uncomment the 9.2.0.1 version and build values. Running puppet again will perform the following:

1. splunk forwarder package is upgraded
   1. splunk service is stopped as part of the package upgrade process
2. new license agreement is automatically accepted
   1. license agreement must be accepted or the splunk service will fail to start
3. splunk service is started

# Tell the module to get packages directly from Splunk.
class { 'splunk::params':
  version  => '9.1.0',
  build    => '1c86ca0bacc3',
  #version  => '9.2.0.1',
  #build    => 'd8ae995bf219',
  src_root => 'https://download.splunk.com',
}

# Specifying package_ensure => 'latest' will ensure that the splunk and
# splunkforwarder packages will be upgraded when you specify newer values for
# version and build.
class { 'splunk::forwarder':
  package_ensure => 'latest',
}

Reference

See in file REFERENCE.md.

Limitations

• Upgrades are tested from Splunk 9.1.0 to 9.2.0.1.
• New installations of splunk up to version 7.2.X are supported, but upgrades from 7.0.X to >= 7.0.X are not fully tested

Development

Learn how to get involved in this and other Vox Pupuli module development on our docs site.

Release Notes/Contributors/Etc

See the CHANGELOG.md or list of contributors.

Reference

Table of Contents

Classes

• splunk: This class is unused and doesn't do anything but make default data accessible
• splunk::enterprise: Install and configure an instance of Splunk Enterprise
• splunk::enterprise::config: Private class declared by Class[splunk::enterprise] to contain all the configuration needed for a base install of Splunk Enterprise
• splunk::enterprise::install: Private class declared by Class[splunk::enterprise] to contain or define through additional platform specific sub-class, the required steps for successfully installing Splunk Enterprise
• splunk::enterprise::install::nix: Private class declared by Class[splunk::enterprise::install] to provide platform specific installation steps on Linux or Unix type systems.
• splunk::enterprise::password::manage: Implements the direct management of the Splunk Enterprise admin password so it can be used outside of regular management of the whole stack to facilitate admin password resets through Bolt Plans.

Note: Entirely done to make this implementation consistent with the method used to manage admin password seeding.

• splunk::enterprise::password::seed: Implements the seeding and reseeding of the Splunk Enterprise admin password so it can be used outside of regular management of the whole stack to facilitate admin password resets through Bolt Plans
• splunk::enterprise::service: Private class declared by Class[splunk::enterprise] to define a service as its understood by Puppet using a dynamic set of data or platform specific sub-classes
• splunk::enterprise::service::nix: Private class declared by Class[splunk::enterprise::service] to provide platform specific service management on Linux or Unix type systems.
• splunk::forwarder: Install and configure an instance of Splunk Universal Forwarder
• splunk::forwarder::config: Private class declared by Class[splunk::forwarder] to contain all the configuration needed for a base install of the Splunk Universal Forwarder
• splunk::forwarder::install: Private class declared by Class[splunk::forwarder] to contain or define through additional platform specific sub-class, the required steps for successfully installing the Splunk Universal Forwarder
• splunk::forwarder::password::manage: Implements the direct management of the Splunk Forwarder admin password so it can be used outside of regular management of the whole stack to facilitate admin password resets through Bolt Plans.

Note: Entirely done to make this implementation consistent with the method used to manage admin password seeding.

• splunk::forwarder::password::seed: Implements the seeding and reseeding of the Splunk Forwarder admin password so it can be used outside of regular management of the whole stack to facilitate admin password resets through Bolt Plans
• splunk::forwarder::service: Private class declared by Class[splunk::forwarder] to define a service as its understood by Puppet using a dynamic set of data or platform specific sub-classes
• splunk::forwarder::service::nix: Private class declared by Class[splunk::forwarder::service] to provide platform specific service management on Linux or Unix type systems.
• splunk::params: This class takes a small number of arguments (can be set through Hiera) and generates sane default values installation media names and locations. Default ports can also be specified here. This is a parameters class, and contributes no resources to the graph. Rather, it only sets values for parameters to be consumed by child classes.

Defined types

• splunk::addon: Defined type for deploying Splunk Add-ons and Apps from either OS packages or via splunkbase compatible archives

Resource types

• splunk_alert_actions: Manage splunk alert_actions settings in alert_actions.conf
• splunk_authentication: Manage splunk authentication settings in authentication.conf
• splunk_authorize: Manage splunk authorize settings in authorize.conf
• splunk_config: splunk config
• splunk_deploymentclient: Manage splunk deploymentclient entries in deploymentclient.conf
• splunk_distsearch: Manage distsearch entries in distsearch.conf
• splunk_indexes: Manage splunk index settings in indexes.conf
• splunk_input: Manage splunk input settings in inputs.conf
• splunk_limits: Manage splunk limits settings in limits.conf
• splunk_metadata: Manage metadata entries in {default,local}.meta
• splunk_output: Manage splunk output settings in outputs.conf
• splunk_props: Manage splunk prop settings in props.conf
• splunk_server: Manage splunk server settings in server.conf
• splunk_serverclass: Manage splunk serverclass entries in serverclass.conf
• splunk_transforms: Manage splunk transforms settings in transforms.conf
• splunk_uiprefs: Manage splunk web ui settings in ui-prefs.conf
• splunk_web: Manage splunk web settings in web.conf
• splunkforwarder_deploymentclient: Manage splunkforwarder deploymentclient entries in deploymentclient.conf
• splunkforwarder_input: Manage splunkforwarder input settings in inputs.conf
• splunkforwarder_limits: Manage splunkforwarder limit settings in limits.conf
• splunkforwarder_output: Manage splunkforwarder output settings in outputs.conf
• splunkforwarder_props: Manage splunkforwarder props settings in props.conf
• splunkforwarder_server: Manage splunkforwarder server settings in server.conf
• splunkforwarder_transforms: Manage splunkforwarder transforms settings in transforms.conf
• splunkforwarder_web: Manage splunkforwarder web settings in web.conf

Data types

• Splunk::Entinstalloptions
• Splunk::Fwdinstalloptions

Classes

splunk

This class is unused and doesn't do anything but make default data accessible

• Note If you were expecting this class to setup an instance of Splunk Enterprise then please look to Class[splunk::enterprise].

splunk::enterprise

Install and configure an instance of Splunk Enterprise

Examples

Basic usage

include splunk::enterprise

Install specific version and build with admin passord management

class { 'splunk::params':
  version => '7.2.5',
  build   => '088f49762779',
}
class { 'splunk::enterprise':
  package_ensure => latest,
  manage_password => true,
}

Parameters

The following parameters are available in the splunk::enterprise class:

• version
• package_name
• package_ensure
• staging_dir
• path_delimiter
• enterprise_package_src
• package_provider
• manage_package_source
• package_source
• install_options
• splunk_user
• enterprise_homedir
• enterprise_confdir
• service_name
• service_file
• boot_start
• use_default_config
• input_default_host
• input_connection_host
• splunkd_listen
• logging_port
• splunkd_port
• web_httpport
• purge_inputs
• purge_outputs
• purge_authentication
• purge_authorize
• purge_distsearch
• purge_indexes
• purge_limits
• purge_props
• purge_server
• purge_transforms
• purge_web
• manage_password
• seed_password
• reset_seeded_password
• password_config_file
• seed_config_file
• seed_user
• password_content
• password_hash
• secret_file
• secret
• purge_alert_actions
• purge_deploymentclient
• purge_serverclass
• purge_uiprefs

version

Data type: String[1]

Specifies the version of Splunk Enterprise the module should install and manage.

Default value: $splunk::params::version

package_name

Data type: String[1]

The name of the package(s) Puppet will use to install Splunk.

Default value: $splunk::params::enterprise_package_name

package_ensure

Data type: String[1]

Ensure parameter which will get passed to the Splunk package resource.

Default value: $splunk::params::enterprise_package_ensure

staging_dir

Data type: String[1]

Root of the archive path to host the Splunk package.

Default value: $splunk::params::staging_dir

path_delimiter

Data type: String[1]

The path separator used in the archived path of the Splunk package.

Default value: $splunk::params::path_delimiter

enterprise_package_src

Data type: String[1]

The source URL for the splunk installation media (typically an RPM, MSI, etc). If a $src_root parameter is set in splunk::params, this will be automatically supplied. Otherwise it is required. The URL can be of any protocol supported by the pupept/archive module. On Windows, this can be a UNC path to the MSI.

Default value: $splunk::params::enterprise_package_src

package_provider

Data type: Optional[String[1]]

The package management system used to host the Splunk packages.

Default value: $splunk::params::package_provider

manage_package_source

Data type: Boolean

Whether or not to use the supplied enterprise_package_src param.

Default value: true

package_source

Data type: Optional[String[1]]

Optional The source URL for the splunk installation media (typically an RPM, MSI, etc). If enterprise_package_src parameter is set in splunk::params and manage_package_source is true, this will be automatically supplied. Otherwise it is required. The URL can be of any protocol supported by the puppet/archive module. On Windows, this can be a UNC path to the MSI.

Default value: undef

install_options

Data type: Splunk::Entinstalloptions

This variable is passed to the package resources' install_options parameter.

Default value: $splunk::params::enterprise_install_options

splunk_user

Data type: String[1]

The user to run Splunk as.

Default value: $splunk::params::splunk_user

enterprise_homedir

Data type: Stdlib::Absolutepath

Specifies the Splunk Enterprise home directory.

Default value: $splunk::params::enterprise_homedir

enterprise_confdir

Data type: Stdlib::Absolutepath

Specifies the Splunk Enterprise configuration directory.

Default value: $splunk::params::enterprise_confdir

service_name

Data type: String[1]

The name of the Splunk Enterprise service.

Default value: $splunk::params::enterprise_service

service_file

Data type: Stdlib::Absolutepath

The path to the Splunk Enterprise service file.

Default value: $splunk::params::enterprise_service_file

boot_start

Data type: Boolean

Whether or not to enable splunk boot-start, which generates a service file to manage the Splunk Enterprise service.

Default value: $splunk::params::boot_start

use_default_config

Data type: Boolean

Whether or not the module should manage a default set of Splunk Enterprise configuration parameters.

Default value: true

input_default_host

Data type: String[1]

Part of the default config. Sets the splunk_input default host.

Default value: $facts['networking']['fqdn']

input_connection_host

Data type: String[1]

Part of the default config. Sets the splunk_input connection host.

Default value: 'dns'

splunkd_listen

Data type: Stdlib::IP::Address

The address on which splunkd should listen.

Default value: '127.0.0.1'

logging_port

Data type: Stdlib::Port

The port to receive TCP logs on.

Default value: $splunk::params::logging_port

splunkd_port

Data type: Stdlib::Port

The management port for Splunk.

Default value: $splunk::params::splunkd_port

web_httpport

Data type: Stdlib::Port

The port on which to service the Splunk Web interface.

Default value: 8000

purge_inputs

Data type: Boolean

If set to true, inputs.conf will be purged of configuration that is no longer managed by the splunk_input type.

Default value: false

purge_outputs

Data type: Boolean

If set to true, outputs.conf will be purged of configuration that is no longer managed by the splunk_output type.

Default value: false

purge_authentication

Data type: Boolean

If set to true, authentication.conf will be purged of configuration that is no longer managed by the splunk_authentication type.

Default value: false

purge_authorize

Data type: Boolean

If set to true, authorize.conf will be purged of configuration that is no longer managed by the splunk_authorize type.

Default value: false

purge_distsearch

Data type: Boolean

If set to true, distsearch.conf will be purged of configuration that is no longer managed by the splunk_distsearch type.

Default value: false

purge_indexes

Data type: Boolean

If set to true, indexes.conf will be purged of configuration that is no longer managed by the splunk_indexes type.

Default value: false

purge_limits

Data type: Boolean

If set to true, limits.conf will be purged of configuration that is no longer managed by the splunk_limits type.

Default value: false

purge_props

Data type: Boolean

If set to true, props.conf will be purged of configuration that is no longer managed by the splunk_props type.

Default value: false

purge_server

Data type: Boolean

If set to true, server.conf will be purged of configuration that is no longer managed by the splunk_server type.

Default value: false

purge_transforms

Data type: Boolean

If set to true, transforms.conf will be purged of configuration that is no longer managed by the splunk_transforms type.

Default value: false

purge_web

Data type: Boolean

If set to true, web.conf will be purged of configuration that is no longer managed by the splunk_web type.

Default value: false

manage_password

Data type: Boolean

If set to true, Manage the contents of splunk.secret and passwd.

Default value: $splunk::params::manage_password

seed_password

Data type: Boolean

If set to true, Manage the contents of splunk.secret and user-seed.conf.

Default value: $splunk::params::seed_password

reset_seeded_password

Data type: Boolean

If set to true, deletes password_config_file to trigger Splunk's password import process on restart of the Splunk services.

Default value: $splunk::params::reset_seeded_password

password_config_file

Data type: Stdlib::Absolutepath

Which file to put the password in i.e. in linux it would be /opt/splunk/etc/passwd.

Default value: $splunk::params::enterprise_password_config_file

seed_config_file

Data type: Stdlib::Absolutepath

Which file to place the admin password hash in so its imported by Splunk on restart.

Default value: $splunk::params::enterprise_seed_config_file

seed_user

Data type: String[1]

The local user (usually 'admin') imported by Splunk.

Default value: $splunk::params::seed_user

password_content

Data type: String[1]

The hashed password username/details for the user.

Default value: $splunk::params::password_content

password_hash

Data type: String[1]

The hashed password for the admin user.

Default value: $splunk::params::password_hash

secret_file

Data type: Stdlib::Absolutepath

Which file we should put the secret in.

Default value: $splunk::params::enterprise_secret_file

secret

Data type: String[1]

The secret used to salt the splunk password.

Default value: $splunk::params::secret

purge_alert_actions

Data type: Boolean

Default value: false

purge_deploymentclient

Data type: Boolean

Default value: false

purge_serverclass

Data type: Boolean

Default value: false

purge_uiprefs

Data type: Boolean

Default value: false

splunk::enterprise::config

Private class declared by Class[splunk::enterprise] to contain all the configuration needed for a base install of Splunk Enterprise

splunk::enterprise::install

Private class declared by Class[splunk::enterprise] to contain or define through additional platform specific sub-class, the required steps for successfully installing Splunk Enterprise

splunk::enterprise::install::nix

Private class declared by Class[splunk::enterprise::install] to provide platform specific installation steps on Linux or Unix type systems.

splunk::enterprise::password::manage

Implements the direct management of the Splunk Enterprise admin password so it can be used outside of regular management of the whole stack to facilitate admin password resets through Bolt Plans.

Note: Entirely done to make this implementation consistent with the method used to manage admin password seeding.

Parameters

The following parameters are available in the splunk::enterprise::password::manage class:

• manage_password
• password_config_file
• password_content
• secret_file
• secret
• service
• mode
• splunk_user

manage_password

Data type: Boolean

If set to true, Manage the contents of splunk.secret and passwd.

Default value: $splunk::params::manage_password

password_config_file

Data type: Stdlib::Absolutepath

Which file to put the password in i.e. in linux it would be /opt/splunk/etc/passwd.

Default value: $splunk::params::forwarder_password_config_file

password_content

Data type: String[1]

The hashed password username/details for the user.

Default value: $splunk::params::password_content

secret_file

Data type: Stdlib::Absolutepath

Which file we should put the secret in.

Default value: $splunk::params::forwarder_secret_file

secret

Data type: String[1]

The secret used to salt the splunk password.

Default value: $splunk::params::secret

service

Data type: String[1]

Name of the Splunk Enterprise service that needs to be restarted after files are updated, not applicable when running in agent mode.

Default value: $splunk::params::enterprise_service

mode

Data type: Enum['agent', 'bolt']

The class is designed to work in two ways, as a helper that is called by Class[splunk::enterprise::config] or leveraged independently from with in a Bolt Plan. The value defaults to "bolt" implicitly assuming that anytime it is used outside of Class[splunk::enterprise::config], it is being used by Bolt

Default value: 'bolt'

splunk_user

Data type: String[1]

Default value: $splunk::params::splunk_user

splunk::enterprise::password::seed

Implements the seeding and reseeding of the Splunk Enterprise admin password so it can be used outside of regular management of the whole stack to facilitate admin password resets through Bolt Plans

Parameters

The following parameters are available in the splunk::enterprise::password::seed class:

• reset_seeded_password
• password_config_file
• seed_config_file
• seed_user
• password_hash
• secret_file
• secret
• service
• mode
• splunk_user

reset_seeded_password

Data type: Boolean

If set to true, deletes password_config_file to trigger Splunk's password import process on restart of the Splunk services.

Default value: $splunk::params::reset_seeded_password

password_config_file

Data type: Stdlib::Absolutepath

Which file to put the password in i.e. in linux it would be /opt/splunk/etc/passwd.

Default value: $splunk::params::enterprise_password_config_file

seed_config_file

Data type: Stdlib::Absolutepath

Which file to place the admin password hash in so its imported by Splunk on restart.

Default value: $splunk::params::enterprise_seed_config_file

seed_user

Data type: String[1]

The local user (usually 'admin') imported by Splunk.

Default value: $splunk::params::seed_user

password_hash

Data type: String[1]

The hashed password for the admin user.

Default value: $splunk::params::password_hash

secret_file

Data type: Stdlib::Absolutepath

Which file we should put the secret in.

Default value: $splunk::params::enterprise_secret_file

secret

Data type: String[1]

The secret used to salt the splunk password.

Default value: $splunk::params::secret

service

Data type: String[1]

Name of the Splunk Enterprise service that needs to be restarted after files are updated, not applicable when running in agent mode.

Default value: $splunk::params::enterprise_service

mode

Data type: Enum['agent', 'bolt']

The class is designed to work in two ways, as a helper that is called by Class[splunk::enterprise::config] or leveraged independently from with in a Bolt Plan. The value defaults to "bolt" implicitly assuming that anytime it is used outside of Class[splunk::enterprise::config], it is being used by Bolt

Default value: 'bolt'

splunk_user

Data type: String[1]

Default value: $splunk::params::splunk_user

splunk::enterprise::service

Private class declared by Class[splunk::enterprise] to define a service as its understood by Puppet using a dynamic set of data or platform specific sub-classes

splunk::enterprise::service::nix

Private class declared by Class[splunk::enterprise::service] to provide platform specific service management on Linux or Unix type systems.

splunk::forwarder

Install and configure an instance of Splunk Universal Forwarder

Examples

Basic usage

include splunk::forwarder

Install specific version and build with admin passord management

class { 'splunk::params':
  version => '7.2.5',
  build   => '088f49762779',
}
class { 'splunk::forwarder':
  package_ensure => latest,
  manage_password => true,
}

Parameters

The following parameters are available in the splunk::forwarder class:

• server
• version
• package_name
• package_ensure
• staging_dir
• path_delimiter
• forwarder_package_src
• package_provider
• manage_package_source
• package_source
• install_options
• splunk_user
• forwarder_homedir
• forwarder_confdir
• service_name
• service_file
• boot_start
• use_default_config
• splunkd_listen
• splunkd_port
• logging_port
• purge_inputs
• purge_outputs
• purge_props
• purge_transforms
• purge_web
• forwarder_input
• forwarder_output
• manage_password
• seed_password
• reset_seeded_password
• password_config_file
• seed_config_file
• seed_user
• password_content
• password_hash
• secret_file
• secret
• addons
• allow_insecure
• purge_deploymentclient

server

Data type: String[1]

The fqdn or IP address of the Splunk server.

Default value: $splunk::params::server

version

Data type: String[1]

Specifies the version of Splunk Forwarder the module should install and manage.

Default value: $splunk::params::version

package_name

Data type: String[1]

The name of the package(s) Puppet will use to install Splunk Forwarder.

Default value: $splunk::params::forwarder_package_name

package_ensure

Data type: String[1]

Ensure parameter which will get passed to the Splunk package resource.

Default value: $splunk::params::forwarder_package_ensure

staging_dir

Data type: String[1]

Root of the archive path to host the Splunk package.

Default value: $splunk::params::staging_dir

path_delimiter

Data type: String[1]

The path separator used in the archived path of the Splunk package.

Default value: $splunk::params::path_delimiter

forwarder_package_src

Data type: String[1]

The source URL for the splunk installation media (typically an RPM, MSI, etc). If a $src_root parameter is set in splunk::params, this will be automatically supplied. Otherwise it is required. The URL can be of any protocol supported by the puppet/archive module. On Windows, this can be a UNC path to the MSI.

Default value: $splunk::params::forwarder_package_src

package_provider

Data type: Optional[String[1]]

The package management system used to host the Splunk packages.

Default value: $splunk::params::package_provider

manage_package_source

Data type: Boolean

Whether or not to use the supplied forwarder_package_src param.

Default value: true

package_source

Data type: Optional[String[1]]

Optional The source URL for the splunk installation media (typically an RPM, MSI, etc). If enterprise_package_src parameter is set in splunk::params and manage_package_source is true, this will be automatically supplied. Otherwise it is required. The URL can be of any protocol supported by the puppet/archive module. On Windows, this can be a UNC path to the MSI.

Default value: undef

install_options

Data type: Splunk::Fwdinstalloptions

This variable is passed to the package resources' install_options parameter.

Default value: $splunk::params::forwarder_install_options

splunk_user

Data type: String[1]

The user to run Splunk as.

Default value:

versioncmp($version, '9.1.0') ? {
    -1 => $splunk::params::splunk_user,
    default => 'splunkfwd'

forwarder_homedir

Data type: Stdlib::Absolutepath

Specifies the Splunk Forwarder home directory.

Default value: $splunk::params::forwarder_homedir

forwarder_confdir

Data type: Stdlib::Absolutepath

Specifies the Splunk Forwarder configuration directory.

Default value: $splunk::params::forwarder_confdir

service_name

Data type: String[1]

The name of the Splunk Forwarder service.

Default value: $splunk::params::forwarder_service

service_file

Data type: Stdlib::Absolutepath

The path to the Splunk Forwarder service file.

Default value: $splunk::params::forwarder_service_file

boot_start

Data type: Boolean

Whether or not to enable splunk boot-start, which generates a service file to manage the Splunk Forwarder service.

Default value: $splunk::params::boot_start

use_default_config

Data type: Boolean

Whether or not the module should manage a default set of Splunk Forwarder configuration parameters.

Default value: true

splunkd_listen

Data type: Stdlib::IP::Address

The address on which splunkd should listen.

Default value: '127.0.0.1'

splunkd_port

Data type: Stdlib::Port

The management port for Splunk.

Default value: $splunk::params::splunkd_port

logging_port

Data type: Stdlib::Port

The port on which to send and listen for logs.

Default value: $splunk::params::logging_port

purge_inputs

Data type: Boolean

Optional If set to true, inputs.conf will be purged of configuration that is no longer managed by the splunkforwarder_input type.

Default value: false

purge_outputs

Data type: Boolean

Optional If set to true, outputs.conf will be purged of configuration that is no longer managed by the splunk_output type.

Default value: false

purge_props

Data type: Boolean

Optional If set to true, props.conf will be purged of configuration that is no longer managed by the splunk_props type.

Default value: false

purge_transforms

Data type: Boolean

Optional If set to true, transforms.conf will be purged of configuration that is no longer managed by the splunk_transforms type.

Default value: false

purge_web

Data type: Boolean

Optional If set to true, web.conf will be purged of configuration that is no longer managed by the splunk_web type.

Default value: false

forwarder_input

Data type: Hash

Used to override the default forwarder_input type defined in splunk::params.

Default value: $splunk::params::forwarder_input

forwarder_output

Data type: Hash

Used to override the default forwarder_output type defined in splunk::params.

Default value: $splunk::params::forwarder_output

manage_password

Data type: Boolean

If set to true, Manage the contents of splunk.secret and passwd.

Default value: $splunk::params::manage_password

seed_password

Data type: Boolean

If set to true, Manage the contents of splunk.secret and user-seed.conf.

Default value: $splunk::params::seed_password

reset_seeded_password

Data type: Boolean

If set to true, deletes password_config_file to trigger Splunk's password import process on restart of the Splunk services.

Default value: $splunk::params::reset_seeded_password

password_config_file

Data type: Stdlib::Absolutepath

Which file to put the password in i.e. in linux it would be /opt/splunkforwarder/etc/passwd.

Default value: $splunk::params::forwarder_password_config_file

seed_config_file

Data type: Stdlib::Absolutepath

Which file to place the admin password hash in so its imported by Splunk on restart.

Default value: $splunk::params::forwarder_seed_config_file

seed_user

Data type: String[1]

The local user (usually 'admin') imported by Splunk.

Default value: $splunk::params::seed_user

password_content

Data type: String[1]

The hashed password username/details for the user.

Default value: $splunk::params::password_content

password_hash

Data type: String[1]

The hashed password for the admin user.

Default value: $splunk::params::password_hash

secret_file

Data type: Stdlib::Absolutepath

Which file we should put the secret in.

Default value: $splunk::params::forwarder_secret_file

secret

Data type: String[1]

The secret used to salt the splunk password.

Default value: $splunk::params::secret

addons

Data type: Hash

Manage a splunk addons, see splunk::addons.

Default value: {}

allow_insecure

Data type: Boolean

Disable certificate verification when connecting to SSL hosts to download packages.

Default value: $splunk::params::allow_insecure

purge_deploymentclient

Data type: Boolean

Default value: false

splunk::forwarder::config

Private class declared by Class[splunk::forwarder] to contain all the configuration needed for a base install of the Splunk Universal Forwarder

splunk::forwarder::install

Private class declared by Class[splunk::forwarder] to contain or define through additional platform specific sub-class, the required steps for successfully installing the Splunk Universal Forwarder

splunk::forwarder::password::manage

Implements the direct management of the Splunk Forwarder admin password so it can be used outside of regular management of the whole stack to facilitate admin password resets through Bolt Plans.

Note: Entirely done to make this implementation consistent with the method used to manage admin password seeding.

Parameters

The following parameters are available in the splunk::forwarder::password::manage class:

• manage_password
• password_config_file
• password_content
• secret_file
• secret
• service
• mode
• splunk_user

manage_password

Data type: Boolean

If set to true, Manage the contents of splunk.secret and passwd.

Default value: $splunk::params::manage_password

password_config_file

Data type: Stdlib::Absolutepath

Which file to put the password in i.e. in linux it would be /opt/splunkforwarder/etc/passwd.

Default value: $splunk::params::enterprise_password_config_file

password_content

Data type: String[1]

The hashed password username/details for the user.

Default value: $splunk::params::password_content

secret_file

Data type: Stdlib::Absolutepath

Which file we should put the secret in.

Default value: $splunk::params::enterprise_secret_file

secret

Data type: String[1]

The secret used to salt the splunk password.

Default value: $splunk::params::secret

service

Data type: String[1]

Name of the Splunk Enterprise service that needs to be restarted after files are updated, not applicable when running in agent mode.

Default value: $splunk::params::forwarder_service

mode

Data type: Enum['agent', 'bolt']

The class is designed to work in two ways, as a helper that is called by Class[splunk::forwarder::config] or leveraged independently from with in a Bolt Plan. The value defaults to "bolt" implicitly assuming that anytime it is used outside of Class[splunk::forwarder::config], it is being used by Bolt

Default value: 'bolt'

splunk_user

Data type: String[1]

Default value: $splunk::params::splunk_user

splunk::forwarder::password::seed

Implements the seeding and reseeding of the Splunk Forwarder admin password so it can be used outside of regular management of the whole stack to facilitate admin password resets through Bolt Plans

Parameters

The following parameters are available in the splunk::forwarder::password::seed class:

• reset_seeded_password
• password_config_file
• seed_config_file
• seed_user
• password_hash
• secret_file
• secret
• service
• mode
• splunk_user

reset_seeded_password

Data type: Boolean

If set to true, deletes password_config_file to trigger Splunk's password import process on restart of the Splunk services.

Default value: $splunk::params::reset_seeded_password

password_config_file

Data type: Stdlib::Absolutepath

Which file to put the password in i.e. in linux it would be /opt/splunkforwarder/etc/passwd.

Default value: $splunk::params::forwarder_password_config_file

seed_config_file

Data type: Stdlib::Absolutepath

Which file to place the admin password hash in so its imported by Splunk on restart.

Default value: $splunk::params::forwarder_seed_config_file

seed_user

Data type: String[1]

The local user (usually 'admin') imported by Splunk.

Default value: $splunk::params::seed_user

password_hash

Data type: String[1]

The hashed password for the admin user.

Default value: $splunk::params::password_hash

secret_file

Data type: Stdlib::Absolutepath

Which file we should put the secret in.

Default value: $splunk::params::forwarder_secret_file

secret

Data type: String[1]

The secret used to salt the splunk password.

Default value: $splunk::params::secret

service

Data type: String[1]

Name of the Splunk Forwarder service that needs to be restarted after files are updated, not applicable when running in agent mode.

Default value: $splunk::params::forwarder_service

mode

Data type: Enum['agent', 'bolt']

The class is designed to work in two ways, as a helper that is called by Class[splunk::forwarder::config] or leveraged independently from with in a Bolt Plan. The value defaults to "bolt" implicitly assuming that anytime it is used outside of Class[splunk::forwarder::config], it is being used by Bolt

Default value: 'bolt'

splunk_user

Data type: String[1]

Default value: $splunk::params::splunk_user

splunk::forwarder::service

Private class declared by Class[splunk::forwarder] to define a service as its understood by Puppet using a dynamic set of data or platform specific sub-classes

splunk::forwarder::service::nix

Private class declared by Class[splunk::forwarder::service] to provide platform specific service management on Linux or Unix type systems.

splunk::params

This class takes a small number of arguments (can be set through Hiera) and generates sane default values installation media names and locations. Default ports can also be specified here. This is a parameters class, and contributes no resources to the graph. Rather, it only sets values for parameters to be consumed by child classes.

Parameters

The following parameters are available in the splunk::params class:

• version
• build
• splunkd_port
• logging_port
• server
• splunk_user
• src_root
• boot_start
• forwarder_installdir
• enterprise_installdir
• default_host
• manage_net_tools
• allow_insecure

version

Data type: String[1]

The version of Splunk to install. This will be in the form x.y.z; e.g. "4.3.2".

Default value: '9.2.0.1'

build

Data type: String[1]

Splunk packages are typically named based on the platform, architecture, version, and build. Puppet can determine the platform information automatically but a build number must be supplied in order to correctly construct the path to the packages. A build number will be six digits; e.g. "123586".

Default value: 'd8ae995bf219'

splunkd_port

Data type: Stdlib::Port

The splunkd port.

Default value: 8089

logging_port

Data type: Stdlib::Port

The port on which to send logs, and listen for logs.

Default value: 9997

server

Data type: String[1]

Optional fqdn or IP of the Splunk Enterprise server. Used for setting up the default TCP output and input.

Default value: 'splunk'

splunk_user

Data type: String[1]

The user that splunk runs as.

Default value:

$facts['os']['family'] ? {
    'windows' => 'Administrator',
    default => versioncmp($version, '8.0.0') ? { -1 => 'root', default => 'splunk'

src_root

Data type: String[1]

The root URL at which to find the splunk packages. The sane-default logic assumes that the packages are located under this URL in the same way that they are placed on download.splunk.com. The URL can be any protocol that the puppet/archive module supports. This includes both puppet:// and http://.

The expected directory structure is:

$root_url/
└── products/
    ├── universalforwarder/
    │   └── releases/
    |       └── $version/
    |           └── $platform/
    |               └── splunkforwarder-${version}-${build}-${additl}
    └── splunk/
        └── releases/
            └── $version/
                └── $platform/
                    └── splunk-${version}-${build}-${additl}

A semi-populated example of src_root contains:

$root_url/
└── products/
    ├── universalforwarder/
    │   └── releases/
    |       └── 7.2.4.2/
    |           ├── linux/
    |           |   ├── splunkforwarder-7.2.4.2-fb30470262e3-linux-2.6-amd64.deb
    |           |   ├── splunkforwarder-7.2.4.2-fb30470262e3-linux-2.6-intel.deb
    |           |   └── splunkforwarder-7.2.4.2-fb30470262e3-linux-2.6-x86_64.rpm
    |           ├── solaris/
    |           └── windows/
    |               └── splunkforwarder-7.2.4.2-fb30470262e3-x64-release.msi
    └── splunk/
        └── releases/
            └── 7.2.4.2/
                └── linux/
                    ├── splunk-7.2.4.2-fb30470262e3-linux-2.6-amd64.deb
                    ├── splunk-7.2.4.2-fb30470262e3-linux-2.6-intel.deb
                    └── splunk-7.2.4.2-fb30470262e3-linux-2.6-x86_64.rpm

Default value: 'https://download.splunk.com'

boot_start

Data type: Boolean

Enable Splunk to start at boot, create a system service file.

WARNING: Toggling boot_start from false to true will cause a restart of Splunk Enterprise and Forwarder services.

Default value: true

forwarder_installdir

Data type: Optional[String[1]]

Optional directory in which to install and manage Splunk Forwarder

Default value: undef

enterprise_installdir

Data type: Optional[String[1]]

Optional directory in which to install and manage Splunk Enterprise

Default value: undef

default_host

Data type: String[1]

The host property in inputs.conf. Defaults to the server's hostname.

Default value: $facts['clientcert']

manage_net_tools

Data type: Boolean

From Splunk 7.2.2+ the package net-tools is required to be installed on the system. By default this module manages the resource Package[net-tools], if this resource is already declared on your code base, you can disable this flag.

Default value: true

allow_insecure

Data type: Boolean

Disable certificate verification when connecting to SSL hosts to download packages.

Default value: false

Defined types

splunk::addon

Defined type for deploying Splunk Add-ons and Apps from either OS packages or via splunkbase compatible archives

• See also
  • https://docs.splunk.com/Documentation/AddOns/released/Overview/AboutSplunkadd-ons

Examples

Basic usage

splunk::addon { 'Splunk_TA_nix':
  splunkbase_source => 'puppet:///modules/splunk_qd/addons/splunk-add-on-for-unix-and-linux_602.tgz',
  inputs            => {
    'monitor:///var/log'       => {
     'whitelist' => '(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)',
     'blacklist' => '(lastlog|anaconda\.syslog)',
     'disabled'  => 'false'
    },
    'script://./bin/uptime.sh' =>  {
      'disabled' => 'false',
      'interval' => '86400',
      'source' => 'Unix:Uptime',
      'sourcetype' => 'Unix:Uptime'
    }
  }
}

Parameters

The following parameters are available in the splunk::addon defined type:

• splunk_home
• package_manage
• splunkbase_source
• extract_command
• package_name
• owner
• inputs

splunk_home

Data type: Optional[Stdlib::Absolutepath]

Overrides the default Splunk installation target values from Class[splunk::params]

Default value: undef

package_manage

Data type: Boolean

If a package should be installed as part of declaring a new instance of Splunk::Addon

Default value: true

splunkbase_source

Data type: Optional[String[1]]

When set the add-on will be installed from a splunkbase compatible archive instead of OS packages

Default value: undef

extract_command

Data type: Optional[String[1]]

A 'extract_command' to pass to the 'archive' that extracts a splunkbase_source package (helpful for SPL files)

Default value: undef

package_name

Data type: Optional[String[1]]

The OS package to install if you are not installing via splunk compatible archive

Default value: undef

owner

Data type: String[1]

The user that files are owned by when they are created as part of add-on installation

Default value: 'splunk'

inputs

Data type: Hash

A hash of inputs to be configured as part of add-on installation, alterntively you can also define splunk_input or splunkforwarder_input resouces seperately

Default value: {}

Resource types

splunk_alert_actions

Manage splunk alert_actions settings in alert_actions.conf

Parameters

The following parameters are available in the splunk_alert_actions type.

• provider

provider

The specific backend to use for this splunk_alert_actions resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_authentication

Manage splunk authentication settings in authentication.conf

Parameters

The following parameters are available in the splunk_authentication type.

• provider

provider

The specific backend to use for this splunk_authentication resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_authorize

Manage splunk authorize settings in authorize.conf

Parameters

The following parameters are available in the splunk_authorize type.

• provider

provider

The specific backend to use for this splunk_authorize resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_config

splunk config

Parameters

The following parameters are available in the splunk_config type.

• forwarder_confdir
• forwarder_installdir
• name
• server_confdir
• server_installdir

forwarder_confdir

forwarder_installdir

name

namevar

splunk config

server_confdir

server_installdir

splunk_deploymentclient

Manage splunk deploymentclient entries in deploymentclient.conf

Parameters

The following parameters are available in the splunk_deploymentclient type.

• provider

provider

The specific backend to use for this splunk_deploymentclient resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_distsearch

Manage distsearch entries in distsearch.conf

Parameters

The following parameters are available in the splunk_distsearch type.

• provider

provider

The specific backend to use for this splunk_distsearch resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_indexes

Manage splunk index settings in indexes.conf

Parameters

The following parameters are available in the splunk_indexes type.

• provider

provider

The specific backend to use for this splunk_indexes resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_input

Manage splunk input settings in inputs.conf

Parameters

The following parameters are available in the splunk_input type.

• provider

provider

The specific backend to use for this splunk_input resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_limits

Manage splunk limits settings in limits.conf

Parameters

The following parameters are available in the splunk_limits type.

• provider

provider

The specific backend to use for this splunk_limits resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_metadata

Manage metadata entries in {default,local}.meta

Parameters

The following parameters are available in the splunk_metadata type.

• provider

provider

The specific backend to use for this splunk_metadata resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_output

Manage splunk output settings in outputs.conf

Parameters

The following parameters are available in the splunk_output type.

• provider

provider

The specific backend to use for this splunk_output resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_props

Manage splunk prop settings in props.conf

Parameters

The following parameters are available in the splunk_props type.

• provider

provider

The specific backend to use for this splunk_props resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_server

Manage splunk server settings in server.conf

Parameters

The following parameters are available in the splunk_server type.

• provider

provider

The specific backend to use for this splunk_server resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_serverclass

Manage splunk serverclass entries in serverclass.conf

Parameters

The following parameters are available in the splunk_serverclass type.

• provider

provider

The specific backend to use for this splunk_serverclass resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_transforms

Manage splunk transforms settings in transforms.conf

Parameters

The following parameters are available in the splunk_transforms type.

• provider

provider

The specific backend to use for this splunk_transforms resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_uiprefs

Manage splunk web ui settings in ui-prefs.conf

Parameters

The following parameters are available in the splunk_uiprefs type.

• provider

provider

The specific backend to use for this splunk_uiprefs resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunk_web

Manage splunk web settings in web.conf

Parameters

The following parameters are available in the splunk_web type.

• provider

provider

The specific backend to use for this splunk_web resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunkforwarder_deploymentclient

Manage splunkforwarder deploymentclient entries in deploymentclient.conf

Parameters

The following parameters are available in the splunkforwarder_deploymentclient type.

• provider

provider

The specific backend to use for this splunkforwarder_deploymentclient resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunkforwarder_input

Manage splunkforwarder input settings in inputs.conf

Parameters

The following parameters are available in the splunkforwarder_input type.

• provider

provider

The specific backend to use for this splunkforwarder_input resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunkforwarder_limits

Manage splunkforwarder limit settings in limits.conf

Parameters

The following parameters are available in the splunkforwarder_limits type.

• provider

provider

The specific backend to use for this splunkforwarder_limits resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunkforwarder_output

Manage splunkforwarder output settings in outputs.conf

Parameters

The following parameters are available in the splunkforwarder_output type.

• provider

provider

The specific backend to use for this splunkforwarder_output resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunkforwarder_props

Manage splunkforwarder props settings in props.conf

Parameters

The following parameters are available in the splunkforwarder_props type.

• provider

provider

The specific backend to use for this splunkforwarder_props resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunkforwarder_server

Manage splunkforwarder server settings in server.conf

Parameters

The following parameters are available in the splunkforwarder_server type.

• provider

provider

The specific backend to use for this splunkforwarder_server resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunkforwarder_transforms

Manage splunkforwarder transforms settings in transforms.conf

Parameters

The following parameters are available in the splunkforwarder_transforms type.

• provider

provider

The specific backend to use for this splunkforwarder_transforms resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

splunkforwarder_web

Manage splunkforwarder web settings in web.conf

Parameters

The following parameters are available in the splunkforwarder_web type.

• provider

provider

The specific backend to use for this splunkforwarder_web resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

Data types

Splunk::Entinstalloptions

The Splunk::Entinstalloptions data type.

Alias of Variant[Tuple[Hash,Hash,String,3,default], Array[String[1]]]

Splunk::Fwdinstalloptions

The Splunk::Fwdinstalloptions data type.

Alias of Variant[Tuple[Hash,String,1,default], Array[String[1]]]

Changelog

All notable changes to this project will be documented in this file. Each new release typically also includes the latest modulesync defaults. These should not affect the functionality of the module.

10.0.0

Full Changelog

Breaking changes:

• Use namespaced ensure_packages, require puppetlabs/stdlib 9.x #360 (gcoxmoz)
• Drop Ubuntu 18.04 support #355 (zilchms)
• Drop Ubuntu 16.04 support #354 (zilchms)
• Drop Debian 9 support #353 (zilchms)
• Drop Puppet 6 support #343 (bastelfreak)

Implemented enhancements:

• Add Rocky and AlmaLinux 8 and 9 support #359 (zilchms)
• Add EL 8 and 9 support #358 (zilchms)
• Add Ubuntu 22.04 support #357 (zilchms)
• Ensure compatibility with Splunk 9.2.0.1 and 9.0.0 #350 (siegy22)
• Add Puppet 8 support #347 (bastelfreak)
• puppetlabs/stdlib: Allow 9.x #346 (bastelfreak)
• Allow inifile 6.x, concat 9.x, archive 7.x #345 (gcoxmoz)
• enable the puppet-archive allow_insecure parameter #340 (mwpower)

Fixed bugs:

• Splunk 9.0.5+ Package Not Found on RedHat x86_64 #348
• pass4SymmKey not read properly #284
• pass4SymmKey setting causes restarts of splunk #197
• Add workaround for Windows based Splunk UF 9.1.3 known issue #365 (siegy22)
• Safer Splunk Enterprise version check #339 (gsandine)

Merged pull requests:

• Updated README.md to make it clear that this module can download directly from the Splunk website #367 (Tamerz)
• Miscellaneous README improvements #364 (siegy22)
• Fix upgrading Splunk Enterprise #363 (siegy22)
• Allow the user to set encrypted values directly #362 (siegy22)
• Remove legacy top-scope syntax #351 (smortex)

v9.1.1 (2022-07-14)

Full Changelog

Fixed bugs:

• Don't install net-tools on Solaris #335 (davemcdonnell)

v9.1.0 (2022-07-12)

Full Changelog

Implemented enhancements:

• Allow user-seed.conf to set a username besides 'admin' #323 (gcoxmoz)
• Add extract_command as a parameter to splunk::addon #321 (gcoxmoz)

Fixed bugs:

• Forwarder service won't start due to incorrect permissions #310
• Use init provider on solaris when managing service #336 (davemcdonnell)
• Explicitly set user on call to 'splunk enable boot-start' #334 (davemcdonnell)
• Ensure facter doesn't stuck in interactive session while retrieving splunk forwarder version #320 (mvandegarde)

Closed issues:

• Warning: Secrets file NOT found #330
• Facter splunk version #280
• Splunk enterprise fact hangs partial install #238

Merged pull requests:

• Allow up-to-date dependencies #318 (smortex)

v9.0.0 (2021-08-09)

Full Changelog

Breaking changes:

• Drop Puppet 5, add Puppet 7 support #313 (smortex)
• Drop EOL Debian 8; Add Debian 9/10 support #306 (bastelfreak)
• Drop CentOS 6 support #305 (bastelfreak)

Implemented enhancements:

• puppet/archive: allow 5.x #309 (bastelfreak)
• Add Ubuntu 18.04/20.04 support #307 (bastelfreak)
• add option to manage net-tools package #303 (mcmartins)
• Add support for FreeBSD #282 (martijndegouw)
• Add support for OpenSUSE #281 (martijndegouw)
• Add ability to override default-host configuration #279 (dave-pollock)

Fixed bugs:

• Corrupt MSI installer #311
• Fix systemd service file locations to documented locations #297 (martijndegouw)
• Workaround a change in behavior of ensure_packages with stdlib #296 (martijndegouw)
• Check if splunk forwarder was already installed when seeding password. #278 (mattk42)

Closed issues:

• child class splunk::forwarder::password::seed has a typo in the fact #289
• Hard coded dependency net-tools #275
• Cant figure out how to set the index that splunk-forwarder sends to #205

Merged pull requests:

• Allow latest dependencies #316 (bastelfreak)
• update puppet-strings documentation #302 (bastelfreak)
• Use a more concise rspec-puppet syntax #301 (ekohl)
• adopt test to newer rspec-puppet syntax #300 (bastelfreak)
• Correct web_httpport field name #299 (thebeanogamer)
• modulesync 3.0.0 & puppet-lint updates #293 (bastelfreak)
• (docs) cleaned up the TBD sections. #291 (binford2k)
• Support ppc64le #290 (treydock)
• changing fact name #288 (jose-lmax)
• Use voxpupuli-acceptance #283 (ekohl)

v8.0.0 (2020-02-12)

Full Changelog

Breaking changes:

• drop Ubuntu 14.04 support #267 (bastelfreak)
• Add 7.2 support and refactor module #215 (nick-markowski)
• modulesync 2.5.1 and drop puppet 4 #211 (bastelfreak)

Implemented enhancements:

• Support upgrading splunk forwarding and accepting ToS #269 (treydock)
• Setup admin account through user-seed.conf #242 (ody)
• Set user and group for addon installation #241 (ody)
• Refactor defined type Splunk::Addon #224 (ody)
• Compare decrypted values to see if they are insync #221 (alexjfisher)
• Add the ability to override package_source #209 (beezly)

Fixed bugs:

• Purging of inputs and outputs don't work on forwarder #157
• Fix flaky acceptance tests #260 (ody)
• Windows fixes #234 (kreeuwijk)
• Fix purging of resources #220 (alexjfisher)

Closed issues:

• Install package updates happen before service changes #263
• Install of systemd unit file doesn't actually work #262
• How to point splunk forwarder to a deploymentserver which listening on 8089? #248
• Error with ini_file autoload #239
• I think $service_name is missing under params.pp. I think we need to add $service_name = [ 'splunk', 'splunkd', 'splunkweb' ] #229
• Setting up splunk admin could be easier #226
• Optionally manage splunk user/group #223
• Splunk_serverclass exists but is not documented #218
• Module does not work with Splunk 7.1.x or 7.2.x #213
• Unable to create symlink #212
• Unable to set user for forwarder service #210
• Strange issues during unit tests with Puppet 5.3.2 #156

Merged pull requests:

• allow puppetlabs/inifile 4.x #268 (bastelfreak)
• Fix systemd support and service subclass ordering #265 (treydock)
• Clean up acceptance spec helper #261 (ekohl)
• add secret_file parameter to Windows #254 (kreeuwijk)
• Allow puppetlabs/concat 6.x and puppet/archive 4.x #240 (alexjfisher)
• Allow puppetlabs/stdlib 6.x #236 (alexjfisher)
• fix osfamily = 'windows' and kernel = 'windows' in lowercase #233 (kreeuwijk)
• Allow puppetlabs/inifile 3.x #231 (dhoppe)
• Documentation style updates #227 (ody)
• Address post-merge comments on PR #224 #225 (ody)
• Add splunk_serverclass documentation to README #219 (rbclark)
• Add documentation for two file types. #207 (dafydd2277)
• Add splunkforwarder_version fact #206 (treydock)

v7.3.0 (2018-10-19)

Full Changelog

Implemented enhancements:

• Make splunk_user configurable. #195 (mdwheele)

Fixed bugs:

• file_path not set for splunkforwarder_limits resource #202
• Fixes #202 #203 (Renelast)
• Improve ftr license agreement #199 (Joshua-Snapp)

Merged pull requests:

• Allow empty local and outputs files to keep centralized Splunk happier. #201 (gregswift)
• modulesync 2.2.0 and allow puppet 6.x #200 (bastelfreak)
• Allow puppetlabs/stdlib 5.x and puppetlabs/concat 5.x #193 (bastelfreak)

v7.2.1 (2018-08-20)

Full Changelog

Fixed bugs:

• Add --no-prompt to the initial splunk start (required on 7.1.X) #191 (ralfbosz)

Closed issues:

• Module does not seem to work with splunkforwarder 7.X #186

v7.2.0 (2018-06-14)

Full Changelog

Implemented enhancements:

• New Custom Type For Managing .meta files #176 (michaelweiser)

Fixed bugs:

• fix unknown variable: staged_package #179 (bastelfreak)

Closed issues:

• Bump dependency constraint for the puppetlabs/inifile module #172

Merged pull requests:

• Allow this module to be installed with puppet-archive 3.0.0 #184 (mpdude)
• Allow forwarder to fully support alternate install directories #183 (Nekototori)
• drop EOL OSs; fix puppet version range #182 (bastelfreak)
• Rely on beaker-hostgenerator for docker nodesets #181 (ekohl)
• bump puppet to latest supported version 4.10.0 #178 (bastelfreak)
• Remove unsupported use of proc in title patterns #174 (treydock)
• (maint) Bumping inifile dependency from > 2.0.0 to > 3.0.0 #173 (TraGicCode)

v7.1.0 (2017-12-09)

Full Changelog

Implemented enhancements:

• Update splunk installer directory structure + enable automated tests #149

Fixed bugs:

• Error on using ini_setting #77
• The splunk::forwarder::purge_inputs generates error #69

Closed issues:

• Agent run fails: no parameter named 'purge_forwarder_deploymentclient' #158
• Allow /opt/splunkforwarder/var/run/splunk splunkd.pid to run as splunk #154
• Erro deploying Splunk both Server and Forwarder #76
• Need a splunkforwarder_input defined resource type #75

Merged pull requests:

• Update README #162 (arjenz)
• replace validate_string with assert_type #161 (bastelfreak)

v7.0.0 (2017-10-04)

Full Changelog

Breaking changes:

• BREAKING: Ability to download from download.splunk.com #150 (TraGicCode)

Implemented enhancements:

• Add serverclass type #147 (TraGicCode)

Closed issues:

• Create a type to manage deployment server "ServerClasses" #146

Merged pull requests:

• v7.0.0 Release #152 (TraGicCode)

v6.3.1 (2017-09-26)

Full Changelog

Fixed bugs:

• Fix config file location for splunkforwarder_deploymentclient, deployment client, and alert_actions. #144 (treydock)

Merged pull requests:

• Release v6.3.1 #145 (TraGicCode)

v6.3.0 (2017-09-25)

Full Changelog

Implemented enhancements:

• Add splunk_alert_actions type. #142 (TraGicCode)
• Add deploymentclient types #141 (TraGicCode)
• Add Purge + File Management for splunk_uiprefs #124 (treydock)

Closed issues:

• Add Windows Server 2016 + Ubuntu 16.04 to Supported OS's #137

Merged pull requests:

• v6.3.0 release #143 (TraGicCode)

v6.2.0 (2017-09-24)

Full Changelog

Implemented enhancements:

• Replace Staging with archive module #127

Closed issues:

• Evaluation Error: Unknown variable: 'splunk::params::forwarder_install_options' #97

Merged pull requests:

• 6.2.0 Release #139 (TraGicCode)
• Added ubuntu 16.04 & 2016 + 2008R2 support. #138 (TraGicCode)
• Replace staging module with archive module #128 (TraGicCode)

v6.1.0 (2017-09-20)

Full Changelog

Implemented enhancements:

• Ability to manage ui-prefs.conf #103
• Added splunkforwarder_server and splunkforwarder_limits providers/types. #118 (nicholaspearson)
• Allow redirecting of settings into custom contexts #87 (michaelweiser)

Fixed bugs:

• splunkd_port not defined for forwarder #133
• concat dependency is missing from metadata.json #122
• splunkforwarder_server not working #121
• Fix .conf file modes for Windows forwarders #114 (natemccurdy)
• Allow for installing packages from UNC paths on Windows #113 (natemccurdy)
• Fix resource ordering in splunk class so that splunk types will properly notify services #91 (treydock)

Closed issues:

• Ruby load error when using splunk::forwarder on Windows #110

Merged pull requests:

• Release v6.1.0 #135 (TraGicCode)
• SplunkForwarder has no concept of a splunkd_port #134 (TraGicCode)
• Remove unused spec_helper_system.rb #132 (wyardley)
• SplunkForwarder has no concept of a server_service. #130 (TraGicCode)
• Update missing concat dependency in acceptance tests. #129 (TraGicCode)
• wire up splunkforwarder_server type #126 (alexcreek)
• Added missing concat dependency to metadata.json + .fixtures.yml #123 (TraGicCode)
• Fix typo in extension filename #117 (gregoirefra)
• This commit adds the pkg_provider 'chocolatey' to the module #108 (ralfbosz)
• Ability to configure ui-prefs.conf #104 (TraGicCode)
• Set forwarder_install_options to be undef for OS other than Windows. #99 (alexqyle)

v6.0.0 (2017-05-25)

Full Changelog

Fixed bugs:

• Fix Windows Forwarder Installdir #102 (TraGicCode)

Closed issues:

• Support .conf files in non-standard locations #88
• Warnings produced when splunk resources are in catalog #86

Merged pull requests:

• Bump release for 6.0.0 #112 (petems)
• Add LICENSE file #109 (alexjfisher)
• This commit sets the splunk_user for Windows to 'administrator' #107 (ralfbosz)
• Lint fixes #101 (treydock)
• types: Fix purging when section contains '//' #96 (jameslikeslinux)
• splunk_config: Only load other splunk types #95 (jameslikeslinux)
• Remove unneded blank lines #93 (roidelapluie)
• Allow splunk server services to be overridden #90 (treydock)
• Ensure /etc/init.d/splunk is created before splunk services #89 (treydock)
• Update README.md from puppetlabs-splunk #85 (Cinderhaze)
• Modulesync 0.18.0 #83 (bastelfreak)

v5.1.0 (2017-01-12)

Full Changelog

Closed issues:

• module doesn't notify splunk restart when changing an input #63

Merged pull requests:

• release 5.1.0 #82 (bastelfreak)
• modulesync 0.16.7 #81 (bastelfreak)
• Bump min version_requirement for Puppet + deps #80 (juniorsysadmin)
• modulesync 0.16.6 #79 (bastelfreak)
• modulesync 0.16.4 #78 (bastelfreak)
• modulesync 0.16.3 #74 (bastelfreak)
• Make the file reference use the variable and not a fixed path #73 (ralfbosz)
• modulesync 0.15.0 #72 (bastelfreak)
• Revert "Release deprecated version" #70 (hunner)
• Add missing badges #66 (dhoppe)
• Update based on voxpupuli/modulesync_config 0.14.1. This might fix #62 #64 (dhoppe)

v5.0.2 (2016-10-05)

Full Changelog

Fixed bugs:

• added package dependency to splunk::addon types #59 (crayfishx)

Closed issues:

• Invalid parameter key_val_separator #4
• inheritence and version overrides #3
• Add ability to upgrade universal forwarders and servers #1

Merged pull requests:

• prepped 5.0.2 #60 (crayfishx)

v5.0.1 (2016-10-04)

Full Changelog

Fixed bugs:

• Notify service from addons #57 (crayfishx)

Merged pull requests:

• Prepped 5.0.1 #58 (crayfishx)

v5.0.0 (2016-10-03)

Full Changelog

Closed issues:

• Add other supported OSes to metadata.json #54

Merged pull requests:

• prepped 5.0.0 #56 (crayfishx)
• Added rspec tests for types and splunk_config and other bugfixes #55 (crayfishx)
• Bug fixes, lint, rubocop, spec tests etc. #53 (alexjfisher)
• Add 'Build Status' badge #52 (alexjfisher)
• Modulesync 0.12.7 #51 (bastelfreak)
• Fixed service restarts with forwarders #50 (crayfishx)
• [REVIEW] [MODULES-3520] refactored types and providers and added purging #49 (crayfishx)
• (maint) Fix resource order for installing splunk forwarders #47 (briancain)

4.0.0 (2016-04-11)

Full Changelog

Merged pull requests:

• (maint) Release prep. #45 (bmjen)
• Fix typo in README. #44 (Ziaunys)
• Update README with type documentation. #43 (Ziaunys)
• Fix module errors discovered while testing. #42 (Ziaunys)
• Add acceptance test skeleton. #41 (Ziaunys)
• Change file mode to string. #40 (Ziaunys)
• Add a more modern version of our README template with updates. #39 (Ziaunys)
• Various updates and fixes #38 (Ziaunys)
• Update the resource ordering for the new Splunk types. #37 (Ziaunys)
• Add conditional logic for using the staging module #36 (Ziaunys)
• Create additional Splunk types/providers #35 (Ziaunys)
• Add splunk_server type and provider #34 (Ziaunys)
• Correct the descriptions of existing splunk types #33 (Ziaunys)
• Actually use the variable somewhere #32 (kyledecot)
• Server ensure #31 (kyledecot)
• Adds param for ensuring forwarder can be the latest argument #30 (bmjen)
• forwarder::pkg_provider should default to $splunk::params::pkg_provider #29 (hunner)
• Fix dependencies #28 (mpdude)
• (MODULES-2953) fix order of assignments #27 (DavidS)
• added technology addon feature #26 (crayfishx)
• config items are collected with tag - make sure it exists #25 (asquelt)
• Expose splunk forwarder windows install options #14 (nanliu)

3.2.1 (2015-09-08)

Full Changelog

Merged pull requests:

• 3.2.1 prep #24 (underscorgan)
• MODULES-2448 - Improved collector compatibility #23 (underscorgan)

3.2.0 (2015-07-21)

Full Changelog

Merged pull requests:

• Release 3.2.0 #19 (hunner)
• Update splunkforwarder_output #18 (hunner)
• Repository and password changes #17 (ckyriakidou)
• (MODULES-2096) Move default cases last #16 (DavidS)

3.1.1 (2014-12-18)

Full Changelog

Merged pull requests:

• 3.1.1 prep #13 (underscorgan)
• Fix lint issues #12 (underscorgan)
• Add solaris sparc parameters. #10 (nanliu)

3.1.0 (2014-08-06)

Full Changelog

Merged pull requests:

• 3.1.0 prep #11 (underscorgan)
• Update the name of the module for PMT install. #8 (metcalfc)
• Add integration tests and fix forwarder bug #7 (hunner)
• Add T&Ps for Splunk indexer and forwarder props and transforms #6 (hunner)
• Add dependency on stdlib >= 2.4.0 #5 (hunner)

3.0.1 (2013-12-02)

Full Changelog

3.0.0 (2013-11-22)

Full Changelog

2.0.1 (2013-10-25)

Full Changelog

2.0.0 (2013-09-30)

Full Changelog

0.3.0 (2013-08-27)

Full Changelog

Merged pull requests:

• typo in puppet module install command #2 (fiddyspence)

0.2.0 (2012-12-18)

Full Changelog

* This Changelog was automatically generated by github_changelog_generator