All Apps and Add-ons

Data not coming to ansible

lmjoin
Explorer

Hello,

No data on Ansible apps on splunk, i have done as below

1.Install this Ansible Monitoring & Diagnostics using the normal Splunk process
2.In Splunk add a HTTP Event Collector data input with a sourcetype of _json. Ensure to enable tokens and disable SSL
3.copy the splunk.py Ansible callback file, currently in the apps bin directory, into a directory within the root of your Ansible playbook called callback_plugins
4.Update your "ansible.cfg" with settings from the Splunk HTTP Event Collector data input as below
In ansible.cfg
at bottom
callback_whitelist = splunk

[callback_splunk]
url = http://35.200.188.84:8088/services/collector/event
authtoken = 2ecefa94-ffa5-4c81-af22-8e3eff29c612

0 Karma

dbagdanoff
Explorer

i had the same issue until i placed the callback_whitelist = splunk in the [defaults] section of anisible.cfg

0 Karma

tsaikumar009
Explorer

which index are you routing the events to from HEC. Did you verify if that index exists in the indexer?,which index are you routing the ansible events to from HEC, did you verify if that index has been created in the indexers?

0 Karma

mgbhm
New Member

Just on the same problem... see my Ansible-info in my own index, if I search it via "search and reporting" index="myownindex" I see the ansible data. Therefore the ansible-data is inserted. the Ansible Splunk app is empty... I miss a config where to set the index the app is looking into, the Event Collector-Box doesnt show the HEC.
I had a look into the Settings->Indexes and the Index is bound to app Ansibe_Splunk

0 Karma

mgbhm
New Member

ah!
Found something, didnt remember to see that in the documents in:
/opt/splunk/etc/apps/Ansible_Splunk/default/macros.conf there is a
[AnsibleData]
definition = index=main

I changed the main to "myownindex" and it works

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What search are you using to look for the Ansible data?

---
If this reply helps you, Karma would be appreciated.
0 Karma

jbrocks
Communicator

Is the data only missing in the app or in general Splunk environment?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...