Deployment Architecture

Can Splunk Deployment Server push out new admin passwords?

Splunk Employee
Splunk Employee

I need to push out a new admin password to all of my remote Splunk instances/forwarders.

Can I use Splunk Deployment Manager to do this or do I need to use another tool?

Splunk Employee
Splunk Employee

You would need another tool. To push out new Splunk passwords, would need to, on each node, either:

  • execute the command ./splunk edit user myuserid -password mynewpassword. Deployment Server can not easily be used to execute commands.
  • replace the file etc/passwd, etc/auth/splunk.secret, and all other files that contain encrypts using etc/auth/splunk.secret which usually includes just etc/system/local/server.conf. These files much of course all match via splunk.secret. Deployment Server can not be effectively used to distribute these files.

Splunk Employee
Splunk Employee

Puppet is perhaps a bit large for the word 'tool'. Like a software build engine, you kind of have to sink a certain amount of time into them to see big returns. http://www.puppetlabs.com/ cfengine is comparable. http://www.cfengine.org/

0 Karma

Super Champion

What is Puppet? Can someone provide a link if this is a recommended tool?

0 Karma

Splunk Employee
Splunk Employee

yes, puppet can work by pushing out copies of the above-named files to remote nodes, or by executing a command.

0 Karma

Splunk Employee
Splunk Employee

What about using something like Puppet? I imagine that should work.

Splunk Employee
Splunk Employee

No, deployment server only pushes out App configurations, nothing to do with users, passwords or Splunk version updates. You might want to file an Enhancement Request if this is something you foresee a need for though.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!