0 
0 0 0 Table of Contents
Introduction:
Splunk forwarder installation can be accomplished using Ansible. In this guide, we are about to see a small playbook which can be used for multiple times with any numbers of remote servers.
In my case, the requirement came to install on hundreds of RHEL 7 servers. Creating playbook took 20 mins by referring to existing playbooks and official guide. Finally completed installing on all servers within 10 mins.
Article Updated with latest Splunk version 8.1.0 installing on CentOS 8.3, RHEL 8.x versions.
Modules we are using in this playbook
Before start using this playbook replace “your_username” with a remote user account which you are using to manage servers. This playbook builds only with copy, yum, shell, command and debug modules. This is more than enough to handle this simple installation and managing the forwarder service.
Splunk Forwarder Download
The forwarder package version I’m using in this guide is a very recent one. If you are looking for an older version installation guide, have a look into Splunk forwarder installation guide.
Ansible Related Articles
- Install and configure Ansible Automation IT Tool
- Install Ansible using Python installation manager pip
- How to create a host’s Inventory using Ansible
- Managing Groups and User creation using Ansible
- Creating a Logical volume-based file system using Ansible
We need to install python expect package on the remote servers. Now worries, it’s included in the play.
Copy-paste of Playbook
---
- hosts: "{{ hosts_prompt }}"
remote_user: ansible
become: yes
become_method: sudo
vars_prompt:
- name: "hosts_prompt"
prompt: "hostname or host group need to run with Playbook"
private: no
tasks:
- name: Copy the Splunk Forwarder RPM to remote Servers.
copy:
src: /home/ansible/splunkforwarder-8.1.0-f57c09e87251-linux-2.6-x86_64.rpm
dest: /home/ansible/
owner: ansible
group: ansible
mode: 0644
- name: Import GnuPG Public Key for Splunk package
rpm_key:
key: https://docs.splunk.com/images/6/6b/SplunkPGPKey.pub
state: present
- name: Install Splunk Forwarder RPM package on remote servers.
yum:
name:
- python3-pexpect.noarch
- /home/ansible/splunkforwarder-8.1.0-f57c09e87251-linux-2.6-x86_64.rpm
state: present
- name: Copy the Splunk Forwarder config from your centralized server to remote servers.
copy:
src: /home/ansible/splunk_forwarder_output/
dest: /opt/splunkforwarder/etc/system/
directory_mode: yes
owner: splunk
group: splunk
mode: 0600
- name: Start Splunk forwarder service.
remote_user: ansible
become: yes
become_method: sudo
become_user: splunk
expect:
command: /opt/splunkforwarder/bin/splunk start --accept-license
timeout: 60
responses:
(.*)Please enter an administrator username(.*): "admin"
(.*)Please enter a new password(.*): "redhat@1020"
(.*)Please confirm new password(.*): "redhat@1020"
- name: Check Splunk forwarder service.
command:
/opt/splunkforwarder/bin/splunk status
register: service_splunk_status
- name: Report Splunk forwarder Status.
debug:
var: service_splunk_status.stdout_lines
...Password used in this guide is plain text, if you are consider it to encrypt have a look into this guide.
Output for reference.
[ansible@gateway ~]$ ansible-playbook splunk_forwader_install.yaml
hostname or host group need to run with Playbook: spkhosts
PLAY [spkhosts] **********************************************************************************************************************************************************************************************************************************************
TASK [Gathering Facts] ***************************************************************************************************************************************************************************************************************************************
ok: [192.168.0.222]
TASK [Copy the Splunk Forwarder RPM to remote Servers.] ******************************************************************************************************************************************************************************************************
ok: [192.168.0.222]
TASK [Import GnuPG Public Key for Splunk package] ************************************************************************************************************************************************************************************************************
ok: [192.168.0.222]
TASK [Install Splunk Forwarder RPM package on remote servers.] ***********************************************************************************************************************************************************************************************
changed: [192.168.0.222]
TASK [Copy the Splunk Forwarder config from your centralized server to remote servers.] **********************************************************************************************************************************************************************
changed: [192.168.0.222]
TASK [Start Splunk forwarder service.] ***********************************************************************************************************************************************************************************************************************
permissions manually
changed: [192.168.0.222]
TASK [Check Splunk forwarder service.] ***********************************************************************************************************************************************************************************************************************
changed: [192.168.0.222]
TASK [Report Splunk forwarder Status.] ***********************************************************************************************************************************************************************************************************************
ok: [192.168.0.222] => {
"service_splunk_status.stdout_lines": [
"splunkd is running (PID: 11526).",
"splunk helpers are running (PIDs: 11532)."
]
}
PLAY RECAP ***************************************************************************************************************************************************************************************************************************************************
192.168.0.222 : ok=8 changed=4 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
[ansible@gateway ~]$ That’s it, Ansible made our life easier.
Are you looking for Oracle RAC server preparation? Keep in touch you can expect soon. If you need more Ansible relevant articles, you can find at the beginning of this post else scroll little below to find the same.
Conclusion:
Automating RPM installation on the remote servers can be accomplished using a simple playbook. Will come up with more playbook in future. Subscribe to our newsletter to receive the updates.
Thank you for your ansible splunk forwarder installation playbook. I get a warning saying that yum with_items is deprecated. I also hangs when it asks for admin user and password information.
@Anwar Mian,
Article updated, try and let me know how it went through.
Thanks & Regards,
Bobin Lonston
This is a great PB, however, an issue I’ve run into with creating a similar book is during the accept license process, a user name and password are being prompted. I don’t see this addressed in your PB.
@Roy,
Are you performing this from Splunk user or from root user? Whether your Splunk installation owned by any specific user or it’s owned by root user?
Thanks & Regards,
Babin Lonston
@Roy Turner,
Article updated, try and let me know how it went through.