Hello,
our security officer asked me to deploy splunk forwarder on several hosts. I wanted to use puppet for that task. Below is the class I have written to do that. And it installs the rpm package, starts but after using "splunk set deploy-poll" and restarting it (I hope it does ...) the node is not seen on the splunk server. When I run all these commands using shell it works. Can anyone sched some light what is wrong with it ?
The steps (given to me by security officer) are:
service splunk restart
package { $splunk::params::splunk_package_name:
ensure => $splunk::params::splunk_package_version,
require => Yumrepo['netsec'],
notify => Exec['start_splunk'],
}
notify {"start_splunk":
message => 'start_splunk'
}
exec {"start_splunk":
creates => "/opt/splunkforwarder/etc/auth/splunkweb",
command => "/opt/splunkforwarder/bin/splunk start --accept-license",
notify => Exec['set_boot' ],
}
Notify['start_splunk'] -> Exec['start_splunk']
notify {"set_boot":
message => 'set_boot'
}
exec {"set_boot":
command => "/opt/splunkforwarder/bin/splunk enable boot-start --accept-license",
notify => Exec['set_deploy'],
}
Notify['set_boot'] -> Exec['set_boot']
notify {"set_deploy":
message => 'set_deploy'
}
exec {"set_deploy":
creates => "/opt/splunkforwarder/",
command => "/opt/splunkforwarder/bin/splunk set deploy-poll splunkserver:8089 -auth admin:pass",
notify => Service['splunk'],
}
Notify['set_deploy'] -> Exec['set_deploy']
file {'/etc/init.d/splunk':
ensure => file,
require => Exec['set_boot']
}
service {"splunk":
ensure => running,
enable => true,
hasstatus => true,
hasrestart => true,
require => File['/etc/init.d/splunk'],
}
You might want to consider putting --answer-yes after --accept-license if you want this same action to work for the upgrade case.
As for the problem, I think you're now into troubleshooting territory. Did deploymentclient.conf get updated by set deploy-poll as expected? Does splunkd.log show it's trying to connect to that host? Is name resolution and so on socket reachability to that host operating?
did you ever get this work? If you did, wodering if you could post the module?