Sunday, April 13, 2014

How to custom install Splunk Forwarder using Puppet - Part 2

This is a continuation from "How to custom install Splunk Forwarder". I recently had to handle special inputs.conf for special servers. So, I had to separate out the inputs.conf file. In the below example, I named the source file "inputs-web.conf" and "puppet-serial-web.txt" to differentiate the original files from these files.

I added these two sections in to their own spunk::forweb class and removed the original two sections from the original splunk class. I then, simply "include splunk" and "include splunk::forweb" in my nodes declaration and I'm all set.

So, in the future, if I had a need for a special inputs.conf for say, a database machine, I can create a new splunk::fordb class and "include splunk" and "include splunk::fordb" in the node declaration for the database machine.

Example:

    file { "/opt/custom/splunk/splunkforwarder/etc/apps/search/local/inputs.conf":
      ensure  => present,
      source  => "puppet:///modules/splunk/splunk-files/inputs-web.conf",
      group   => "splunk",
      owner   => "splunk",
      mode    => "644",
      require => File["/opt/custom/splunk/splunkforwarder/etc/apps/search/local"],
    }
    file { "/opt/custom/splunk/splunkforwarder/.puppet-serial.txt":
      ensure  => present,
      source  => "puppet:///modules/splunk/splunk-files/puppet-serial-web.txt",
      group   => "splunk",
      owner   => "splunk",
      mode    => "644",
      require => File["/etc/pki/tls/private/cert4splunk.p12"],
    }