Deployment Architecture

docker installed splunkforwarder config help in ansible deployment

Telstra_rdavis
New Member

I have a SUF installed in a docker container and all works OK It is deployed via Ansible. A snip of my Ansible playbook:
*- name: Start Splunk Forwarder container
docker_container:
name: splunk_uf
image: "{{ registry_url}}/splunkuniversalforwarder:7.3"
state: started
hostname: "{{ fqdn }}"
volumes:
- /home/app:/home/app
- /var/log:/var/log
published_ports:
- "9997:9997"
env:
SPLUNK_START_ARGS: "--accept-license"
SPLUNK_PASSWORD: "{{ splunk_forwarder_password }}"

SPLUNK_DEPLOYMENT_SERVER: "{{ splunk_dep_serv }}"*

It builds a deploymentclient.conf file like this:
*[target-broker:deploymentServer]

targetUri = deploymentserver.com:8089*

My splunk guys say it needs to be like this:
*[target-broker:deploymentServer]
targetUri = deploymentserver.com:8089
[deployment-client]
clientName = SPLUNK-APP-NET-$HOSTNAME

disabled=false*

So my question is:
How do I get the [deployment-client] part of the file built with my Ansible playbook?

Thanks in advance,
Rob

0 Karma

DevProfile101
Loves-to-Learn

From your ansible playbook create a new play that will execute a script and the script will append the configuration to deploymentclient.conf 

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...