Installing Splunk Universal Forwarder Using Ansible

Sun, 07 Aug 2016 21:58:00 +0530

Here is an automated approach to installing and initializing the Splunk Universal Forwarder with Ansible.

Variables

splunk_home: /opt/splunkforwarder
splunk_exec: "{{ splunk_home }}/bin/splunk"

Playbook Tasks

- name: Install Splunk Universal Forwarder package
 yum:
 name: splunkforwarder
 state: latest
 become: yes

- name: Check for first-time-run marker file
 stat:
 path: "{{ splunk_home }}/ftr"
 register: result_splunk_ftr_stat

- name: Configure Splunk forwarder on initial installation
 block:
 - name: Ensure existing running splunkd process is stopped
 shell: ps aux | grep -v grep | grep splunkd && pkill -9 splunkd || true

 - name: Accept license agreement and start service
 shell: "{{ splunk_exec }} start --accept-license --answer-yes --no-prompt"

 - name: Enable Splunk forwarder boot-start service
 shell: "{{ splunk_exec }} enable boot-start"
 when: result_splunk_ftr_stat.stat.exists
 become: yes

Run the playbook, and your forwarder is initialized and configured to start on boot.

Splunk on Life

Installing Splunk Universal Forwarder Using Ansible

Variables

Playbook Tasks