Splunk UF Linux : How To Automate Installation

[0xAli]

Hi,

As per the below the Splunk Linux UF installation isn't single command as Splunk MS UF, and the customer doen't have a deployment tool, going with more than 100 UF with manually steps is a huge time.

Anyone has an idea to automate the process?

https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/universal-forwarder-manual... 

[mmccul]

My historical answer was I built a second RPM that deployed enough configuration bits to the Splunk forwarder, required the Splunk forwarder RPM, and ensured that the forwarder was started.

In other words, it wrote a Splunk app into the Forwarder's /opt/splunkforwarder/etc/apps that set up talking to the deployment server to get the rest of the configurations, ensured boot-start was set, and that it started/restarted the forwarder after deployment.  It wasn't hard to create as a custom rpm/dpkg.  

That way, I used the same deployment mechanism as all other packages and could ensure all the site-local bits were there, and just "install this package, which forces installation of the Splunk UF" was all they had to do.

[PickleRick]

This is one of the possible methods - we used a similar approach for some packages in $job-2 - build a custom RPM named <something>-stdconf which would depend on the base package and would perform configuration steps, enable the service, set up users and so on.

But I'm not a big fan of this approach - RPMs are not well suited for this and - especially if the base package changes (like Splunk's migration from splunk to splunkforwarder user) you have to handle a lot of transition cases. And it quickly gets messy.

[livehybrid · Accepted solution]

Hi @0xAli 

Depending on your Linux OS you might be able to use the rpm install package option with the kickstarter file, check out https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/9.1/install-splunk-ente...for more info. 

Personally I would probably look to go at using something like Ansible as an orchestration tool, there is a Splunk Ansible repo which might also be useful as a starting point. Ansible is a great way to deploy out to multiple server that you have SSH access to.

There is a bunch of useful links and comments on the following which might give you some ideas too: https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-Ansible-script-to-automate-installatio...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[PickleRick]

To be honest, I have no idea what "kickstart file" the docs refer to here. The only kickstart file with RH and RH-based distros I know is the kickstart you can write to automate the OS installation.

And generally, at scale, probably the most maintainable solution is to install a clean UF, drop in an app pointing to deployment server (and maybe another one with local Root CA certs if you're using one) and enable boot-start, start service whichever way you feel most comfortable with - shell script, ansible, whatever.