topic Re: installing splunk forwarder using ansible in Installation

installing splunk forwarder using ansible

gauravmsharma — Sun, 26 Jul 2020 15:47:12 GMT

While installing splunk forwarder 8.0.5 using ansible, it is throwing an error saying the url is not correct. I am using a basic block to install the rpm for it.

- name: install splunk

yum:

name: "{{ splunk_fwd_url }}"

state: present

The URL i am using is

https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.0.5&product=universalforwarder&filename=splunkforwarder-8.0.5-a1a6394cc5ae-linux-2.6-x86_64.rpm

I am not sure if this is the correct URL because this use to work fine with the old version (7.0.0) but not in the latest version.

Below is the ansible error for reference

fatal: [default]: FAILED! => {"changed": false, "msg": "Failed to get nevra information from RPM package: https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.0.5&product=universalforwarder&filename=splunkforwarder-8.0.5-a1a6394cc5ae-linux-2.6-x86_64.rpm"}

Re: installing splunk forwarder using ansible

isoutamo — Sun, 26 Jul 2020 16:18:02 GMT

why you don’t first get the rpm on your local repository, then verify that it’s correct and then install it from your ansible control node? It’s much secure that way. You know what you are installing to servers and you don’t need to open FW or use proxy to get that binary.
r. Ismo

Re: installing splunk forwarder using ansible

gauravmsharma — Mon, 27 Jul 2020 07:59:39 GMT

Splunk is a secure source and i have the code to verify the download. Anyways it still does not address my query, is this URL a Download-ble one ?

Re: installing splunk forwarder using ansible

isoutamo — Mon, 27 Jul 2020 13:30:49 GMT

The correct URL to the latests UF seems to be:

'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.0.5&product=universalforwarder&filename=splunkforwarder-8.0.5-a1a6394cc5ae-linux-2.6-x86_64.rpm&wget=true'

For some unknow reason the rest of it has cut/missed on your original question.

r. Ismo

Re: installing splunk forwarder using ansible

gauravmsharma — Mon, 27 Jul 2020 14:30:16 GMT

Still the same now it gives an error on No package matching

fatal: [default]: FAILED! => {"changed": false, "msg": "No package matching 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.0.5&product=splunk&filename=splunk-8.0.5-a1a6394cc5ae-linux-2.6-x86_64.rpm&wget=true' found available, installed or updated", "rc": 126, "results": ["No package matching 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.0.5&product=splunk&filename=splunk-8.0.5-a1a6394cc5ae-linux-2.6-x86_64.rpm&wget=true' found available, installed or updated"]}

PS: In this case i tried installing splunk rpm it gave the error same for UF

Re: installing splunk forwarder using ansible

isoutamo — Mon, 27 Jul 2020 16:17:50 GMT

I suppose that this URL need sing on before it works.

Next URLs works without signing or any authentication.

Splunk server can be found e.g. from URL http://download.splunk.com/products/splunk/releases/7.3.3/linux/splunk-7.3.3-7af3758d0d5e-linux-2.6-x86_64.rpm

And UF can be found here:

http://download.splunk.com/products/universalforwarder/releases/8.0.5/linux/splunkforwarder-8.0.5-a1a6394cc5ae-linux-2.6-x86_64.rpm

r. Ismo

Re: installing splunk forwarder using ansible

gauravmsharma — Tue, 28 Jul 2020 12:31:14 GMT

Works like a charm. Thanks for help

Re: installing splunk forwarder using ansible

RMcCurdyDOTcom — Wed, 06 Mar 2024 18:08:22 GMT

#!/bin/bash ########################## FUNC function UFYUM(){ cd /tmp rpm -Uvh --nodeps `curl -s https://www.splunk.com/en_us/download/universal-forwarder.html\?locale\=en_us | grep -oP '"https:.*(?<=download).*x86_64.rpm"' |sed 's/\"//g' | head -n 1` yum -y install splunkforwarder.x86_64 sleep 5 } function UFDEB(){ cd /tmp wget `curl -s https://www.splunk.com/en_us/download/universal-forwarder.html\?locale\=en_us | grep -oP '"https:.*(?<=download).*amd64.deb"' |sed 's/\"//g' | head -n 1` -O amd64.deb dpkg -i amd64.deb sleep 5 } function UFConf(){ mkdir -p /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/ cd /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/ cat <<EOF> /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/app.conf [install] state = enabled [package] check_for_updates = false [ui] is_visible = false is_manageable = false EOF cat <<EOF> /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/deploymentclient.conf [deployment-client] phoneHomeIntervalInSecs = 60 [target-broker:deploymentServer] targetUri = XXXXXXXXXXXXXXXXXXXXXXX:8089 EOF cat <<EOF> /opt/splunkforwarder/etc/system/local/user-seed.conf [user_info] USERNAME = admin PASSWORD = XXXXXXXXXXXXXXXXXXXXXXXX EOF /opt/splunkforwarder/bin/splunk cmd btool deploymentclient list --debug /opt/splunkforwarder/bin/splunk start --accept-license } ######################################################### MAIN # Check for RPM package managers if command -v yum > /dev/null; then UFYUM UFConf else echo "No YUM package manager found." fi # Check for DEB package managers if command -v dpkg > /dev/null; then UFDEB UFConf else echo "No DEB package manager found." fi