Deploying splunk agent with puppet

[przemol]

Hello,

our security officer asked me to deploy splunk forwarder on several hosts. I wanted to use puppet for that task. Below is the class I have written to do that. And it installs the rpm package, starts but after using "splunk set deploy-poll" and restarting it (I hope it does ...) the node is not seen on the splunk server. When I run all these commands using shell it works. Can anyone sched some light what is wrong with it ?

The steps (given to me by security officer) are:

• yum install ...
• /opt/splunkforwarder/bin/splunk start --accept-license
• /opt/splunkforwarder/bin/splunk enable boot-start
  
• /opt/splunkforwarder/bin/splunk set deploy-poll splunkserver:8089 -auth admin:pass

• service splunk restart

  package { $splunk::params::splunk_package_name:
          ensure          => $splunk::params::splunk_package_version,
          require         => Yumrepo['netsec'],
          notify          => Exec['start_splunk'],
  }
  
  notify {"start_splunk":
          message => 'start_splunk'
  }
  exec {"start_splunk":
          creates => "/opt/splunkforwarder/etc/auth/splunkweb",
          command => "/opt/splunkforwarder/bin/splunk start --accept-license",
          notify  => Exec['set_boot' ],
  }
  Notify['start_splunk'] -> Exec['start_splunk']
  
  notify {"set_boot":
          message => 'set_boot'
  }
  exec {"set_boot":
          command => "/opt/splunkforwarder/bin/splunk enable boot-start --accept-license",
          notify  => Exec['set_deploy'],
  }
  Notify['set_boot'] -> Exec['set_boot']
  
  notify {"set_deploy":
          message => 'set_deploy'
  }
  exec {"set_deploy":
          creates => "/opt/splunkforwarder/",
          command => "/opt/splunkforwarder/bin/splunk set deploy-poll splunkserver:8089 -auth admin:pass",
          notify  => Service['splunk'],
  }
  Notify['set_deploy'] -> Exec['set_deploy']
  
  file {'/etc/init.d/splunk':
          ensure  => file,
          require => Exec['set_boot']
  }
  
  service {"splunk":
          ensure     => running,
          enable     => true,
          hasstatus  => true,
          hasrestart => true,
          require    => File['/etc/init.d/splunk'],
  }
  

[jrodman]

You might want to consider putting --answer-yes after --accept-license if you want this same action to work for the upgrade case.

As for the problem, I think you're now into troubleshooting territory. Did deploymentclient.conf get updated by set deploy-poll as expected? Does splunkd.log show it's trying to connect to that host? Is name resolution and so on socket reachability to that host operating?

[snannapa]

did you ever get this work? If you did, wodering if you could post the module?