Re: [Puppet Users] puppetlabs-splunk needs LOTS of usage examples

Sandor W. Sklar Tue, 28 Jul 2015 11:16:41 -0700

I had the same experience; I wound up rolling my own, because I just needed something simple that worked to set up the forwarder. I’ve attached it, maybe you’ll find it useful.

- Sandy

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/B16AE9A8-47C9-4959-A243-61DAE79CDAE9%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

ssklar-splunk.tar.gz
Description: GNU Zip compressed data

On Jul 28, 2015, at 10:31 AM, Vince Skahan <[email protected]> wrote:

Does anybody actually use the puppetlabs-splunk module ?

I've been battling this for too many hours and have a bunch of questions. I can't really find any references via Google that this is getting much usage, and the documentation in the module itself seems essentially non-existent, but I thought I'd ask just in case:
how do you define a section for inputs.conf that has multiple key=value pairs
If I wanted a inputs.conf stanza of the following, how do I make that happen ?

[monitor:///var/log/nginx]
disabled = false
index = main
sourcetype = nginx


         I came up with the following, but the problem is it only permits 'one' setting and value.....

splunkforwarder_input { 'nginx':
        section => 'monitor:///var/log/nginx',
        setting => 'disabled'
        value => 'false',
      }

Is there a way to get it to accept multiple free-form multiple key=value pairs ? It's using their ini module under the hood isn't it ? Is there a secret decoder ring of examples someplace ?

the README file seems totally wrong to me. On a centos6 system, it doesn't try to install the universal forwarder rpm from the source tree it tells you to build, and it doesn't use the version/build info it tells you to put into parameters. It does a 'yum install splunkforwarder' with odd options, and no (visible to me) way to control yum options, which repo(s) are enabled/disabled, etc.   While the installation 'does' work and it enables and starts the process well, the whole thing seems like half a solution with a tenth of the docs that I'd expect a 'supported' module to have.
FWIW, I only figured out what was expected by reading the (minimal) tests in the module sources. I'd have expected some examples/readme files to save hundreds of potential users that pain.

class { 'splunk::params':
         version => '6.1.2',
         build   => '213098',
         server => 'splunk.apps.oris.washington.edu',
      }
class { 'splunk::forwarder' :

      }

Am I missing something in how to decipher this thing ? Should we have to spend hours trying to reverse engineer a basically undocumented module that doesn't even really say what it does/doesn't support in terms of functionality or should we just shop elsewhere or roll our own ? Guess I'm pretty lost/confused/tired of battling this thing. Ideas ?

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/8b8b7771-8de0-44c0-a419-be847ffe77a0%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Puppet Users] puppetlabs-splunk needs LOTS of usage examples

Reply via email to