Simple installation script for Universal Forwarder

[lguinn2]

When you have more than a few forwarders to maintain, it becomes tedious (and error-prone) to install them one-by-one. Using the Deployment Server is great for keeping the configurations up-to-date and consistent.

But I want to script the installation. This isn't really a Splunk problem, it's more of a scripting problem.

Any great scripts out there? All answers welcome, especially Linux and Windows.

[tv5]

Thanks Iguinn, tweaked this a bit for non-root user account... and this works!

 #!/bin/sh

 HOSTS_FILE="/opt/forwarderlist"
 WGET_CMD="wget -O splunkforwarder..."
 INSTALL_FILE="splunkforwarder-6....tgz"
 DEPLOY_SERVER="xx.xx.xx.xx:8089"
 PASSWORD="newpassword"

 REMOTE_SCRIPT="
 cd /opt
 sudo $WGET_CMD
 sudo tar -xzf $INSTALL_FILE

 sudo useradd -m -r splunk
 sudo chown -R splunk:splunk /opt/splunkforwarder

 ### /opt/splunkforwarder/bin/splunk enable boot-start -user splunk
 sudo -u splunk /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt
 sudo -u splunk /opt/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOY_SERVER\" --accept-license --answer-yes --auto-ports --no-prompt  -auth admin:changeme
 sudo -u splunk /opt/splunkforwarder/bin/splunk edit user admin -password $PASSWORD -auth admin:changeme
 sudo -u splunk /opt/splunkforwarder/bin/splunk restart
 "    

 echo "In 5 seconds, will run the following script on each remote host:"
 echo
 echo "===================="
 echo "$REMOTE_SCRIPT"
 echo "===================="
 echo
 sleep 5
 echo "Reading host logins from $HOSTS_FILE"
 echo
 echo "Starting."
 for DST in `cat "$HOSTS_FILE"`; do
   if [ -z "$DST" ]; then
     continue;
   fi
   echo "---------------------------"
   echo "Installing to $DST"
   sudo ssh -t "$DST" "$REMOTE_SCRIPT"
 done  
 echo "---------------------------"
 echo "Done"

[rwells]

What does DST mean in this scrip and what does it do?

[lguinn2]

DST is a variable. On each iteration of the loop, DST is set to the next host in the HOSTS_FILE.
So at any given point, DST should contain the IP address where the universal forwarder is to be installed.

[lguinn2]

Another script posting - also good

Forwarder Installation Script

[rmorlen]

Thanks for the script.

We have found Splunk incredibly easy to install and upgrade. Much easier that most products. We have UF's installed on 3000+ servers.

[dwaddle]

A couple of comments:

[1] Nothing keeps you from running a purely-internal yum repository to distribute Splunk install images to your servers. Then, "yum update" even works...
[2] Rather than setting the admin password directly, there's always user-seed.conf, which works well for that purpose.
[3] It's not terribly difficult to spin out your own RPM that includes splunk as a dependency - let that RPM (and its included scriplets) deal with post-install configuration

[bilhays]

ssbarnea, that's a bit harsh. We're talking about on the fly configuration, which is not trivial, and this kind of script is very helpful (at least to oldschoolers like myself). Thanks lguinn, this one answers 3-4 questions I had while writing something similar.

[ssbarnea]

Thanks, the above script is a proof of the splunk inability to create easy to install and deploy products. I just hope that they will fix the current silly URL download tricks and provide a solution like this, maybe even RPM and DEB repositories.

[lguinn2]

Documentation here, including another example script...

[jviteka]

Do I need to create a share for this?

[lguinn2]

If you cut-and-paste this script, watch out for the line wrap on the lines that start with
/opt/splunkforwarder

[lguinn2]

This was the shortest script that I could come up with that wasn't completely lame. It is based on a much more sophisticated script that is now part of the documentation.