How do I install Splunk universal forwarder 8.2.6?

[dhimanv]

Hello,

I am trying to install latest version of Splunk universal forwarder using chef cookbook and getting error. Earlier in version 6.5.0, once rpm installed using rpm -ivh splunkuniversal-xx.rpm, I used to run command as:

/splunkuniversal/bin/splunk enable boot-start --accept-license --answer-yes

and then change the password

/splunkuniversal/bin/splunk edit user admin -password xxxxx -roles admin -auth admin:xxxxxx

service splunk start

but now in version 8.2.6, after rpm install, when I am trying to run above commands, it is asking to create user. Is there any change in installation process and how I can automate it again via chef cookbook so hat it should not prompt for user creation ?

Regards,

Dhimanv

[isoutamo]

Splunk has changed the requirements that you must create an "admin" user with password when you are starting a splunk if you haven't that yet.

Here is a way how you can set it in ansible unfortunately I haven't any examples done by chef.

    - name: "Hash the password"
      command: "{{ splunk.exec }} hash-passwd {{ splunk.password }}"
      register: hashed_pwd
      changed_when: hashed_pwd.rc == 0
      become: yes
      become_user: "{{ splunk.user }}"
      no_log: "{{ hide_password }}"

    - name: "Generate user-seed.conf (Linux)"
      ini_file:
        owner: "{{ splunk.user }}"
        group: "{{ splunk.group }}"
        dest: "{{ splunk.home }}/etc/system/local/user-seed.conf"
        section: user_info
        option: "{{ item.opt }}"
        value: "{{ item.val }}"
        mode: 0644
      with_items:
        - {opt: 'USERNAME', val: '{{ splunk.admin_user }}'}
        - {opt: 'HASHED_PASSWORD', val: '{{ hashed_pwd.stdout }}'}
      loop_control:
        label: "{{ item.opt }}"
      when: ansible_system is match("Linux")
      become: yes
      become_user: "{{ splunk.user }}"
      no_log: "{{ hide_password }}"

• https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/User-seedconf
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Secureyouradminaccount

Another way is if you have older version on place then just ensure that you have admin user there with non standard password before you are updating rpm (update not remove + install).

r. Ismo