Installing Splunk Universal Forwarder Using Ansible

splunk_home: /opt/splunkforwarder
splunk_exec: "{{ splunk_home }}/bin/splunk"

- name: Install Splunk Universal Forwarder package
  yum:
    name: splunkforwarder
    state: latest
  become: yes

- name: Check for first-time-run marker file
  stat:
    path: "{{ splunk_home }}/ftr"
  register: result_splunk_ftr_stat

- name: Configure Splunk forwarder on initial installation
  block:
    - name: Ensure existing running splunkd process is stopped
      shell: ps aux | grep -v grep | grep splunkd && pkill -9 splunkd || true

    - name: Accept license agreement and start service
      shell: "{{ splunk_exec }} start --accept-license --answer-yes --no-prompt"

    - name: Enable Splunk forwarder boot-start service
      shell: "{{ splunk_exec }} enable boot-start"
  when: result_splunk_ftr_stat.stat.exists
  become: yes