Forge Home

Modules

Puppet

Resources

PuppetEcosystemPuppet CommunityUpdates

splunk

Manage and deploy Splunk servers and forwarders
Project URLRSS FeedReport issues

197,976 downloads

848 latest version

4.7 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 99.99.99 (deleted)
  • 10.0.0 (latest)
  • 9.1.1
  • 9.1.0
  • 9.0.0
  • 8.0.0
  • 7.3.0
  • 7.2.1
  • 7.2.0
  • 7.1.0
  • 7.0.0
  • 6.3.1
  • 6.3.0
  • 6.2.0
  • 6.1.0
  • 6.0.0
  • 5.1.0
  • 5.0.2
  • 5.0.1
  • 5.0.0
released Mar 27th 2024
This version is compatible with:
  • Puppet Enterprise 2023.8.x, 2023.7.x, 2023.6.x, 2023.5.x, 2023.4.x, 2023.3.x, 2023.2.x, 2023.1.x, 2023.0.x, 2021.7.x, 2021.6.x, 2021.5.x, 2021.4.x, 2021.3.x, 2021.2.x, 2021.1.x, 2021.0.x
  • Puppet >= 7.0.0 < 9.0.0
  • , , , , , , , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'puppet-splunk', '10.0.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add puppet-splunk
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install puppet-splunk --version 10.0.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Download

Documentation

puppet/splunk — version 10.0.0 Mar 27th 2024

Puppet Module For Splunk

CI Code Coverage Puppet Forge Puppet Forge - downloads Puppet Forge - endorsement Puppet Forge - scores

Table of Contents

  1. Overview
  2. Module Description - What the module does and why it is useful
  3. Setup - The basics of getting started with splunk
  4. Usage - Configuration options and additional functionality
  5. Reference - An under-the-hood peek at what the module is doing and how
  6. Limitations - OS compatibility, etc.
  7. Development - Guide for contributing to the module

Overview

This module provides a method to deploy Splunk Enterprise or Splunk Universal Forwarder with common configurations and ensure the services maintain a running state. It provides types/providers to interact with the various Splunk/Forwarder configuration files.

Module Description

This module does not configure firewall rules. Firewall rules will need to be configured separately in order to allow for correct operation of Splunk and the Splunk Universal Forwarder.

Setup

What splunk affects

  • Installs the Splunk/Forwarder package and manages their config files. It does not purge them by default.
  • The module will set up both Splunk Enterprise and Splunk Forwarder to run as the 'root' user on POSIX platforms.
  • By default, enables Splunk Enterprise and Splunk Forwarder boot-start, and uses the vendor-generated service file to manage the splunk service.

Setup Requirements

To begin using this module, use the Puppet Module Tool (PMT) from the command line to install this module:

puppet module install puppet-splunk

This will place the module into your primary module path if you do not utilize the --target-dir directive.

You can also use r10k or code-manager to deploy the module so ensure that you have the correct entry in your Puppetfile.

By default, this module will download the installation packages from https://download.splunk.com.

You can also configure offline installers, there is just a little setup needed.

First, you will need to place your downloaded splunk installers into the files directory, <module_path>/splunk/files/. If you're using r10k or code-manager you'll need to override the splunk::params::src_root parameter to point at a modulepath outside of the Splunk module because each deploy will overwrite the files.

The files must be placed according to directory structure example given below.

The expected directory structure is:

 $root_url/
 └── products/
     ├── universalforwarder/
     │   └── releases/
     |       └── $version/
     |           └── $platform/
     |               └── splunkforwarder-${version}-${build}-${additl}
     └── splunk/
         └── releases/
             └── $version/
                 └── $platform/
                     └── splunk-${version}-${build}-${additl}

A semi-populated example files directory might then contain:

$root_url/
└── products/
    ├── universalforwarder/
    │   └── releases/
    |       └── 9.2.0/
    |           ├── linux/
    |           |   ├── splunkforwarder-9.2.0-1fff88043d5f-linux-2.6-amd64.deb
    |           |   ├── splunkforwarder-9.2.0-1fff88043d5f-linux-2.6-intel.deb
    |           |   └── splunkforwarder-9.2.0-1fff88043d5f.x86_64.rpm
    |           ├── solaris/
    |           └── windows/
    |               └── splunkforwarder-9.2.0-1fff88043d5f-x64-release.msi
    └── splunk/
        └── releases/
            └── 9.2.0/
                └── linux/
                    ├── splunk-9.2.0-1fff88043d5f-linux-2.6-amd64.deb
                    ├── splunk-9.2.0-1fff88043d5f-linux-2.6-intel.deb
                    └── splunk-9.2.0-1fff88043d5f.x86_64.rpm

Second, you will need to supply the splunk::params class with three critical pieces of information.

  • The version of Splunk you are using
  • The build of Splunk you are using
  • The root URL to use to retrieve the packages

In the example given above, the version is 9.2.0, the build is 1fff88043d5f, and the root URL is puppet:///modules/splunk. See the splunk::params class documentation for more information.

Beginning with splunk

Once the Splunk packages are hosted in the users repository or hosted by the Puppet Server in the modulepath the module is ready to deploy.

Usage

If a user is installing Splunk Enterprise with packages provided from their modulepath, this is the most basic way of installing Splunk Server with default settings:

include splunk::enterprise

This is the most basic way of installing the Splunk Universal Forwarder with default settings:

class { 'splunk::params':
    server => $my_splunk_server,
}

include splunk::forwarder

Once both Splunk Enterprise and Splunk Universal Forwarder have been deployed on their respective nodes, the Forwarder is ready to start sending logs.

In order to start sending some log data, users can take advantage of the Splunkforwarder_input type. Here is a basic example of adding an input to start sending Puppet Server logs:

@splunkforwarder_input { 'puppetserver-sourcetype':
  section => 'monitor:///var/log/puppetlabs/puppetserver/puppetserver.log',
  setting => 'sourcetype',
  value   => 'puppetserver',
  tag     => 'splunk_forwarder'
}

This virtual resource will get collected by the ::splunk::forwarder class if it is tagged with splunk_forwarder and will add the appropriate setting to the inputs.conf file and refresh the service.

Setting the admin user's password

The module has the facility to set Splunk Enterprise's admin password at installation time by leveraging the user-seed.conf method described as a best practice in the Splunk docs. The way Splunk implements this prevents Puppet from managing the password in an idempotent way but makes resetting the password through the web console possible. You can also use Puppet to do a one time reset too by setting the appropriate parameters on splunk::enterprise but leaving these parameters set to true will cause corrective change on each run of the Puppet Agent.

class { 'splunk::enterprise':
  seed_password    => true,
  password_hash    => '$6$jxSX7ra2SNzeJbYE$J95eTTMJjFr/lBoGYvuJUSNKvR7befnBwZUOvr/ky86QGqDXwEwdbgPMfCxW1/PuB/IkC94QLNravkABBkVkV1',
}

Alternatively the splunk::enterprise::password::seed class can be used independently of the Puppet Agent through a Bolt Plan apply block.

Upgrade splunk and splunkforwarder packages

This module has the ability to install and upgrade the splunk and splunkforwarder packages. All you have to do is declare package_ensure => 'latest' when calling the ::splunk or ::splunk::forwarder classes.

Upgrade Example

The following code will install the 9.1.0 version of the splunk forwarder. Then comment out the 9.1.0 version and build values and uncomment the 9.2.0.1 version and build values. Running puppet again will perform the following:

  1. splunk forwarder package is upgraded
    1. splunk service is stopped as part of the package upgrade process
  2. new license agreement is automatically accepted
    1. license agreement must be accepted or the splunk service will fail to start
  3. splunk service is started
# Tell the module to get packages directly from Splunk.
class { 'splunk::params':
  version  => '9.1.0',
  build    => '1c86ca0bacc3',
  #version  => '9.2.0.1',
  #build    => 'd8ae995bf219',
  src_root => 'https://download.splunk.com',
}

# Specifying package_ensure => 'latest' will ensure that the splunk and
# splunkforwarder packages will be upgraded when you specify newer values for
# version and build.
class { 'splunk::forwarder':
  package_ensure => 'latest',
}

Reference

See in file REFERENCE.md.

Limitations

  • Upgrades are tested from Splunk 9.1.0 to 9.2.0.1.
  • New installations of splunk up to version 7.2.X are supported, but upgrades from 7.0.X to >= 7.0.X are not fully tested

Development

Learn how to get involved in this and other Vox Pupuli module development on our docs site.

Release Notes/Contributors/Etc

See the CHANGELOG.md or list of contributors.