Installing Splunk Universal Forwarder Using Ansible
Here is an automated approach to installing and initializing the Splunk Universal Forwarder with Ansible. Variables splunk_home: /opt/splunkforwarder splunk_exec: "{{ splunk_home }}/bin/splunk" Playbook Tasks - name: Install Splunk Universal Forwarder package yum: name: splunkforwarder state: latest become: yes - name: Check for first-time-run marker file stat: path: "{{ splunk_home }}/ftr" register: result_splunk_ftr_stat - name: Configure Splunk forwarder on initial installation block: - name: Ensure existing running splunkd process is stopped shell: ps aux | grep -v grep | grep splunkd && pkill -9 splunkd || true - name: Accept license agreement and start service shell: "{{ splunk_exec }} start --accept-license --answer-yes --no-prompt" - name: Enable Splunk forwarder boot-start service shell: "{{ splunk_exec }} enable boot-start" when: result_splunk_ftr_stat.stat.exists become: yes Run the playbook, and your forwarder is initialized and configured to start on boot.