Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Deploying splunk agent with puppet

$
0
0

Hello,

our security officer asked me to deploy splunk forwarder on several hosts. I wanted to use puppet for that task. Below is the class I have written to do that. And it installs the rpm package, starts but after using "splunk set deploy-poll" and restarting it (I hope it does ...) the node is not seen on the splunk server. When I run all these commands using shell it works. Can anyone sched some light what is wrong with it ?

The steps (given to me by security officer) are:

  • yum install ...
  • /opt/splunkforwarder/bin/splunk start --accept-license
  • /opt/splunkforwarder/bin/splunk enable boot-start
  • /opt/splunkforwarder/bin/splunk set deploy-poll splunkserver:8089 -auth admin:pass
  • service splunk restart

    package { $splunk::params::splunk_package_name:
            ensure          => $splunk::params::splunk_package_version,
            require         => Yumrepo['netsec'],
            notify          => Exec['start_splunk'],
    }
    
    notify {"start_splunk":
            message => 'start_splunk'
    }
    exec {"start_splunk":
            creates => "/opt/splunkforwarder/etc/auth/splunkweb",
            command => "/opt/splunkforwarder/bin/splunk start --accept-license",
            notify  => Exec['set_boot' ],
    }
    Notify['start_splunk'] -> Exec['start_splunk']
    
    notify {"set_boot":
            message => 'set_boot'
    }
    exec {"set_boot":
            command => "/opt/splunkforwarder/bin/splunk enable boot-start --accept-license",
            notify  => Exec['set_deploy'],
    }
    Notify['set_boot'] -> Exec['set_boot']
    
    notify {"set_deploy":
            message => 'set_deploy'
    }
    exec {"set_deploy":
            creates => "/opt/splunkforwarder/",
            command => "/opt/splunkforwarder/bin/splunk set deploy-poll splunkserver:8089 -auth admin:pass",
            notify  => Service['splunk'],
    }
    Notify['set_deploy'] -> Exec['set_deploy']
    
    file {'/etc/init.d/splunk':
            ensure  => file,
            require => Exec['set_boot']
    }
    
    service {"splunk":
            ensure     => running,
            enable     => true,
            hasstatus  => true,
            hasrestart => true,
            require    => File['/etc/init.d/splunk'],
    }
    

Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>