Archive
Highlighted

Deploying splunk agent with puppet

New Member

Hello,

our security officer asked me to deploy splunk forwarder on several hosts. I wanted to use puppet for that task. Below is the class I have written to do that. And it installs the rpm package, starts but after using "splunk set deploy-poll" and restarting it (I hope it does ...) the node is not seen on the splunk server. When I run all these commands using shell it works. Can anyone sched some light what is wrong with it ?

The steps (given to me by security officer) are:

  • yum install ...
  • /opt/splunkforwarder/bin/splunk start --accept-license
  • /opt/splunkforwarder/bin/splunk enable boot-start
  • /opt/splunkforwarder/bin/splunk set deploy-poll splunkserver:8089 -auth admin:pass
  • service splunk restart

    package { $splunk::params::splunk_package_name:
            ensure          => $splunk::params::splunk_package_version,
            require         => Yumrepo['netsec'],
            notify          => Exec['start_splunk'],
    }
    
    notify {"start_splunk":
            message => 'start_splunk'
    }
    exec {"start_splunk":
            creates => "/opt/splunkforwarder/etc/auth/splunkweb",
            command => "/opt/splunkforwarder/bin/splunk start --accept-license",
            notify  => Exec['set_boot' ],
    }
    Notify['start_splunk'] -> Exec['start_splunk']
    
    notify {"set_boot":
            message => 'set_boot'
    }
    exec {"set_boot":
            command => "/opt/splunkforwarder/bin/splunk enable boot-start --accept-license",
            notify  => Exec['set_deploy'],
    }
    Notify['set_boot'] -> Exec['set_boot']
    
    notify {"set_deploy":
            message => 'set_deploy'
    }
    exec {"set_deploy":
            creates => "/opt/splunkforwarder/",
            command => "/opt/splunkforwarder/bin/splunk set deploy-poll splunkserver:8089 -auth admin:pass",
            notify  => Service['splunk'],
    }
    Notify['set_deploy'] -> Exec['set_deploy']
    
    file {'/etc/init.d/splunk':
            ensure  => file,
            require => Exec['set_boot']
    }
    
    service {"splunk":
            ensure     => running,
            enable     => true,
            hasstatus  => true,
            hasrestart => true,
            require    => File['/etc/init.d/splunk'],
    }
    
Tags (2)
0 Karma
Highlighted

Re: Deploying splunk agent with puppet

New Member

did you ever get this work? If you did, wodering if you could post the module?

0 Karma
Highlighted

Re: Deploying splunk agent with puppet

Splunk Employee
Splunk Employee

You might want to consider putting --answer-yes after --accept-license if you want this same action to work for the upgrade case.

As for the problem, I think you're now into troubleshooting territory. Did deploymentclient.conf get updated by set deploy-poll as expected? Does splunkd.log show it's trying to connect to that host? Is name resolution and so on socket reachability to that host operating?

0 Karma