About callemang

callemang · ‎11-04-2021

There are two different projects we discussed, so I am not sure which you are referring to. I looked into both in detail and went with ansible-role-for-splunk (https://github.com/splunk/ansible-role-for-splunk) because splunk-ansible is made for containerized deployments. We have been using that project in Tower for about a year now for new builds, version control in git, and general maintenance. We love it. The project queues off of host groups a lot, so you will need to organize your inventory based off of their recommendations. It's a good structure to keep you organized, though.

callemang · ‎04-09-2021

Hello! I am using Ansible to automate Splunk operations. I have a handler that simply runs: - name: restart splunk shell: "{{ splunk_home }}/bin/splunk restart" become: yes become_user: "{{ splunk_nix_user }}" Occasionally (1 out of every 5), this command will return an exit code with the following output. [...] All preliminary checks passed. Starting splunk server daemon (splunkd)... Done Waiting for web server at https://127.0.0.1:8443 to be available..... WARNING: web interface does not seem to be available! This causes my Ansible Tower job to fail and send out failure notifications to the team. Seconds later, the web interface is available and all is well (except for my pride because of the failure notification). Is there any way to have Splunk wait longer to check for the web UI to be up? Or possibly a way for Ansible to not fail on this exit code or zero? Any help is much appreciated

callemang · ‎02-08-2021

Thanks @masonmorales, I ended up using your ansible-role-for-splunk project for our deployment and made some changes for our needs. Much thanks!

callemang · ‎12-30-2020

@gjanders , great resource! I watched it and learned about the ansible-role-for-splunk project. It seems that both ansible-role-for-splunk and splunk-ansible both have their features and drawbacks. I did, however find an example wrapper in splunk-ansible. I think I'm going to tailor that to work for Centos/RedHat. Much thanks!!

callemang · ‎12-22-2020

Hello! I am new to Splunk and am tasked with automating the deployment (many many indexers on bare metal). I noticed that are two projects on github and was wondering if someone could clarify some questions. https://github.com/splunk/splunk-ansible This project seems thorough, but is it just made for the splunk-docker project? The playbooks only run against localhost, meaning I can only deploy one instance at a time. This doesn't make sense to me, as one of the purposes of Ansible is to run against many hosts at once. https://github.com/splunk/ansible-role-for-splunk This project isn't as built out, but seems like I can deploy multiple instances at once on bare metal. The question is; can I still deploy everything I'll need (indexers, sh, cluster master, etc). I know that these are broad questions. I would just like some advice on what project to go with. Much thanks, Chris

Posts	5
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎12-22-2020

Online Status	Offline
Date Last Visited	‎11-04-2021 09:15 AM

Ansible: restart splunk returning exit code

Deployment with Ansible

Re: Deployment with Ansible

Ansible: restart splunk returning exit code

Re: Deployment with Ansible

Re: Deployment with Ansible

Deployment with Ansible