You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
769 lines
27 KiB
769 lines
27 KiB
## Navigation
|
|
|
|
* [Spec](#spec)
|
|
* [Configuration files](#configuration-files)
|
|
* [Example](#example)
|
|
|
|
---
|
|
|
|
## Spec
|
|
The following is the full spec file for a `default.yml` that controls how Splunk gets provisioned.
|
|
|
|
```
|
|
ansible_post_tasks: <list>
|
|
* list of paths or URLs to custom Ansible playbooks to run AFTER Splunk has been setup using the provided site.yml
|
|
* Default: []
|
|
|
|
ansible_pre_tasks: <list>
|
|
* list of paths or URLs to custom Ansible playbooks to run BEFORE Splunk sets up using the provided site.yml
|
|
* Default: []
|
|
|
|
ansible_environment: <dict>
|
|
* Map of environment variables used only during the execution context of all the Ansible tasks. For more information, see https://docs.ansible.com/ansible/latest/user_guide/playbooks_environment.html
|
|
* Default: {}
|
|
|
|
hide_password: <bool>
|
|
* Boolean that determines whether or not to output Splunk admin passwords through Ansible
|
|
* Default: false
|
|
|
|
retry_num: <int>
|
|
* Number of retries to make for potentially flakey/error-prone tasks
|
|
* Default: 60
|
|
|
|
wait_for_splunk_retry_num: <int>
|
|
* Number of retries to make when waiting for a Splunk instance to be available
|
|
* Default: 60
|
|
|
|
shc_sync_retry_num: <int>
|
|
* Number of retries to make when waiting for sync up with a search head cluster
|
|
* Default: 60
|
|
|
|
retry_delay: <int>
|
|
* Duration of waits between each of the aforementioned retries (in seconds)
|
|
* Default: 6
|
|
|
|
restart_retry_delay: <int>
|
|
* Duration of waits between retries to issue restart command for splunkd (in seconds)
|
|
* Default: 30
|
|
|
|
splunk_home_ownership_enforcement: true
|
|
* Boolean that to control and enable UAC on $SPLUNK_HOME (recommended to be enabled)
|
|
* Default: true
|
|
|
|
config:
|
|
baked: <str>
|
|
* Configuration filename
|
|
* Default: default.yml
|
|
|
|
defaults_dir: <str - filepath>
|
|
* Location on filesystem where the default.yml can be found
|
|
* Default: /tmp/defaults
|
|
|
|
env:
|
|
headers: <str>
|
|
* Define header information (in necessary) when pulling default.yml from a URL
|
|
* Default: null
|
|
|
|
var: <str>
|
|
* Control environment variable name that determines location of default.yml
|
|
* Default: SPLUNK_DEFAULTS_URL
|
|
|
|
verify: <bool>
|
|
* Enable/disable SSL validation
|
|
* Default: true
|
|
host:
|
|
headers: <str>
|
|
* Define header information (in necessary) when pulling default.yml from a URL
|
|
* Default: null
|
|
|
|
url: <str>
|
|
* Define URL to pull default.yml from
|
|
* Default: null
|
|
|
|
verify: <bool>
|
|
* Enable/disable SSL validation
|
|
* Default: true
|
|
|
|
max_delay: <int>
|
|
* Maximum duration (in seconds) between attempts to pull the default.yml from a remote source
|
|
* Default: 60
|
|
|
|
max_retries: <int>
|
|
* Maximum attempts to pull the default.yml from a remote source
|
|
* Default: 3
|
|
|
|
max_timeout: <int>
|
|
* Maximum timeout for attempts to pull the default.yml from a remote source
|
|
* Default: 1200
|
|
|
|
splunkbase_username: <str>
|
|
* Used for authentication when downloading apps from https://splunkbase.splunk.com/ (this is NOT required to even be specified, unless you have SplunkBase apps defined in your splunk.apps_location)
|
|
* NOTE: Use this in combination with splunkbase_password. You will also need to run Ansible using the dynamic inventory script (environ.py) for this to register and work properly.
|
|
* Default: null
|
|
|
|
splunkbase_password: <str>
|
|
* Used for authentication when downloading apps from https://splunkbase.splunk.com/ (this is NOT required to even be specified, unless you have SplunkBase apps defined in your splunk.apps_location)
|
|
* NOTE: Use this in combination with splunkbase_username. You will also need to run Ansible using the dynamic inventory script (environ.py) for this to register and work properly.
|
|
* Default: null
|
|
|
|
splunkbase_token: <str>
|
|
* Used for authentication when downloading apps from https://splunkbase.splunk.com/ (this is NOT required to even be specified, unless you have SplunkBase apps defined in your splunk.apps_location)
|
|
* NOTE: This is ordinarily generated using the dynamic inventory script (environ.py) using the aforementioned `splunkbase_username` and `splunkbase_password` variables above, and every token has an expiry.
|
|
* Default: null
|
|
|
|
cert_prefix: <str>
|
|
* Specify the scheme used for the SplunkD management endpoint (typically port 8089). If you plan on running SplunkD over HTTP, you should set this to "http" so the Ansible plays are aware of the intended scheme.
|
|
* Default: https
|
|
|
|
java_download_url: <str>
|
|
* Java JDK URL that is dynamically fetched and installed at container run-time. For example: "https://download.java.net/java/GA/jdk11/9/GPL/openjdk-11.0.2_linux-x64_bin.tar.gz"
|
|
* Default: null
|
|
|
|
java_update_version: <str>
|
|
* Name of the Java JDK file used for installation. For example: "openjdk-11.0.2_linux-x64_bin.tar.gz"
|
|
* Default: null
|
|
|
|
java_version: <str>
|
|
* String notifying the Ansible plays which version of Java is being installed so variables can be parsed properly. For example: "openjdk:11"
|
|
* Default: null
|
|
|
|
dmc_forwarder_monitoring: <bool>
|
|
* Feature-flag to enable forwarder asset monitoring through the Distributed Management Console (DMC). This is disabled by default.
|
|
* Default: false
|
|
|
|
dmc_asset_interval: <str>
|
|
* Cron-formatted string of the frequency and recurrence of the query that builds the forwarding assets table
|
|
* Default: "3,18,33,48 * * * *"
|
|
|
|
docker: <bool>
|
|
* DEPRECATED - this was used to signal whether or not the instance being provisioned was running in Docker. This does not affect playbook execution at all, but the dynamic inventory script environ.py will set this to setup host::vars mapping as needed.
|
|
|
|
splunk:
|
|
role: <str>
|
|
* Role to assume when setting up Splunk. Accepted values include: splunk_standalone, splunk_search_head, splunk_search_head_captain, splunk_indexer, splunk_deployer, splunk_cluster_master, splunk_deployment_server, splunk_heavy_forwarder, splunk_license_master, splunk_universal_forwarder, and splunk_monitor.
|
|
* Default: splunk_standalone
|
|
|
|
allow_upgrade:
|
|
* Determines whether or not to perform an upgrade (to the splunk.build_location)
|
|
* Default: true
|
|
|
|
build_location: <str>
|
|
* Splunk build location, either on the filesystem or a remote URL
|
|
* Default: null
|
|
|
|
build_url_bearer_token: <str>
|
|
* Bearer token used to provide authorization when fetching a Splunk build from a remote URL.
|
|
* Default: null
|
|
|
|
license_master_url: <str>
|
|
* Hostname of Splunk Enterprise license master instance. May be overridden using SPLUNK_LICENSE_MASTER_URL environment variable.
|
|
* Default: null
|
|
|
|
cluster_master_url: <str>
|
|
* Hostname of Splunk Enterprise cluster master instance. May be overridden using SPLUNK_CLUSTER_MASTER_URL environment variable.
|
|
* Default: null
|
|
|
|
auxiliary_cluster_masters: <list>
|
|
* Array of other cluster masters to support multi-cluster distributed search. The node must be a search head configured to peer an initial cluster master before the masters listed here are added. For more information, see https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch.
|
|
* Default: []
|
|
* Example:
|
|
* auxiliary_cluster_masters:
|
|
* - url: https://master.us-west.corp.net:8089
|
|
* pass4SymmKey: thisisasecret
|
|
* - url: https://master.us-east.corp.net:8089
|
|
* pass4SymmKey: thisisanothersecret
|
|
|
|
deployer_url: null
|
|
* Hostname of Splunk Enterprise deployer instance. May be overridden using SPLUNK_DEPLOYER_URL environment variable.
|
|
* Default: null
|
|
|
|
deployment_client: <dict>
|
|
* Deployment client object that configures `deployment-client` stanza of `deploymentclient.conf` file.
|
|
* Default: null
|
|
|
|
name: null
|
|
* Client name for deployment client. May be overridden using SPLUNK_DEPLOYMENT_CLIENT_NAME environment variable.
|
|
* Default: null
|
|
|
|
search_head_captain_url: null
|
|
* Hostname of Splunk Enterprise search head cluster captain instance. May be overridden using SPLUNK_SEARCH_HEAD_CAPTAIN_URL environment variable.
|
|
* Default: null
|
|
|
|
search_head_cluster_url: null
|
|
* URL of the Splunk search head cluster
|
|
* NOTE: This is being deprecated in favor of `splunk.search_head_captain_url`.
|
|
* Default: null
|
|
|
|
disable_popups: <bool>
|
|
* When set to true, pop-ups/modals will be disabled from login on the homescreen and search app.
|
|
* Default: false
|
|
|
|
preferred_captaincy: <bool>
|
|
* Boolean to determine whether splunk should set a preferred captain. This can have an effect on day 2 operations if the search heads need to be restarted
|
|
* Default: true
|
|
|
|
apps_location: <list>
|
|
* List of apps to install - elements can be in the form of a URL or a location in the filessytem
|
|
* Default: null
|
|
|
|
license_uri: <str>
|
|
* Path or remote URL to a valid Splunk license
|
|
* Default: null
|
|
|
|
ignore_license: <bool>
|
|
* Allow proceeding with a bad/invalid Splunk license
|
|
* Default: false
|
|
|
|
license_download_dest: <str - filepath>
|
|
* Path in filesystem where licenses will be downloaded as
|
|
* Default: /tmp/splunk.lic
|
|
|
|
wildcard_license: <bool>
|
|
* Enable licenses to be interpreted as fileglobs, to support provisioning with multiple Splunk licenses
|
|
* Default: false
|
|
|
|
admin_user: <str>
|
|
* Default admin-level user to run provisioning commands under. It is only possible to change the admin user name at the first-time execution of Splunk Enterprise.
|
|
* Default: admin
|
|
|
|
password: <str>
|
|
* Default Splunk admin user password. This is REQUIRED when starting Splunk, and can only be set during the first-time run of the playbooks. If changes are required to the admin password, they should be done through SplunkWeb/CLI and the new value should be re-entered here.
|
|
* Default: null
|
|
|
|
declarative_admin_password: <bool>
|
|
* When set to true, the playbooks will always enforce that the admin password is set to the value of `password` above. Any changes to the admin password outside of splunk-ansible will be reverted.
|
|
* Default: false
|
|
|
|
user: <str>
|
|
* Host user under which Splunk will run
|
|
* Default: splunk
|
|
|
|
group: <str>
|
|
* Host group under which Splunk will run
|
|
* Default: splunk
|
|
|
|
enable_service: <bool>
|
|
* Determine whether or not to enable Splunk for boot-start (start via sysinitv or systemd, etc.)
|
|
* Default: false
|
|
|
|
service_name: <str>
|
|
* Specify the service name of splunkd when running through sysinitv, systemd, etc.
|
|
* Default: null
|
|
|
|
opt: <str - filepath>
|
|
* Path in filesystem where Splunk will be installed
|
|
* Default: /opt
|
|
|
|
home: <str - filepath>
|
|
* Path in filesystem where SPLUNK_HOME is located
|
|
* Default: /opt/splunk
|
|
|
|
exec: <str - filepath>
|
|
* Path in filesystem where splunk binary exists (this will depend on splunk.home)
|
|
* Default: /opt/splunk/bin/splunk
|
|
|
|
pid: <str - filepath>
|
|
* Path in filesystem of splunk PID file (this will depend on splunk.home)
|
|
* Default: /opt/splunk/var/run/splunk/splunkd.pid
|
|
|
|
app_paths:
|
|
default: <str - filepath>
|
|
* Path in filesystem of default apps (this will depend on splunk.home)
|
|
* Default: /opt/splunk/etc/apps
|
|
|
|
deployment: <str - filepath>
|
|
* Path in filesystem of deployment apps (this will depend on splunk.home)
|
|
* Default: /opt/splunk/etc/deployment-apps
|
|
|
|
httpinput: <str - filepath>
|
|
* Path in filesystem of the HTTP input apps (this will depend on splunk.home)
|
|
* Default: /opt/splunk/etc/apps/splunk_httpinput
|
|
|
|
idxc: <str - filepath>
|
|
* Path in filesystem of indexer cluster master apps (this will depend on splunk.home)
|
|
* Default: /opt/splunk/etc/master-apps
|
|
|
|
shc: <str - filepath>
|
|
* Path in filesystem of search head cluster apps (this will depend on splunk.home)
|
|
* Default: /opt/splunk/etc/shcluster/apps
|
|
|
|
app_paths_install:
|
|
default: <list>
|
|
* List of apps to install into app_paths.default - elements can be in the form of a URL or a location in the filessytem
|
|
* Default: null
|
|
|
|
deployment: <list>
|
|
* List of apps to install into app_paths.deployment - elements can be in the form of a URL or a location in the filessytem
|
|
* Default: null
|
|
|
|
idxc: <list>
|
|
* List of apps to install into app_paths.idxc on the CM to be pushed to the Indexer Cluster - elements can be in the form of a URL or a location in the filessytem
|
|
* Default: null
|
|
|
|
shc: <list>
|
|
* List of apps to install into app_paths.shc on the deployer to be pushed to the Search Head Cluster- elements can be in the form of a URL or a location in the filessytem
|
|
* Default: null
|
|
|
|
hec:
|
|
enable: <bool>
|
|
* Determine whether or not to disable setting up the HTTP event collector (HEC)
|
|
* Default: True
|
|
|
|
ssl: <bool>
|
|
* Determine whether or not to enable SSL on the HTTP event collector (HEC) endpoint
|
|
* Default: True
|
|
|
|
port <int>
|
|
* Determine the port used for the HTTP event collector (HEC) endpoint
|
|
* Default: 8088
|
|
|
|
token: <str>
|
|
* Determine a token to use for the HTTP event collector (HEC) endpoint
|
|
* Default: null
|
|
|
|
cert: <str>
|
|
* Filepath to a custom SSL certificate for HEC
|
|
* Default: null
|
|
|
|
password: <str>
|
|
* SSL password used to create the SSL certificate for HEC
|
|
* Default: null
|
|
|
|
http_enableSSL: <int|bool>
|
|
* Determine whether or not to enable SSL on SplunkWeb
|
|
* Default: 0
|
|
|
|
http_enableSSL_cert: <str>
|
|
* Path in filesystem to SplunkWeb SSL certificate
|
|
* Default: null
|
|
|
|
http_enableSSL_privKey: <str>
|
|
* Path in filesystem to SplunkWeb SSL private key
|
|
* Default: null
|
|
|
|
http_enableSSL_privKey_password: <str>
|
|
* Password used to setup SplunkWeb SSL private key
|
|
* Default: null
|
|
|
|
http_port: <int>
|
|
* Determine the port used for SplunkWeb
|
|
* Default: 8000
|
|
|
|
root_endpoint: <str>
|
|
* Root endpoint used when serving SplunkWeb over a different path
|
|
* Default: null
|
|
|
|
s2s:
|
|
enable: <bool>
|
|
* Determine whether or not to enable Splunk-to-Splunk communication. This is REQUIRED for any distributed topologies.
|
|
* Default: true
|
|
|
|
port: <int>
|
|
* Determine the port used for the Splunk-to-Splunk networking
|
|
* Default: 9997
|
|
|
|
ssl: <bool>
|
|
* When true, enables splunktcp input to use SSL
|
|
* Default: false
|
|
|
|
cert: <str>
|
|
* Coupled with the ssl parameter above, specify the path to the SSL certificate used for splunktcp-ssl
|
|
* Default: null
|
|
|
|
password: <str>
|
|
* Coupled with the ssl parameter above, specify the SSL password used for splunktcp-ssl
|
|
* Default: null
|
|
|
|
ca: <str>
|
|
* Coupled with the ssl parameter above, specify the path to the CA certificate used for splunktcp-ssl
|
|
* Default: null
|
|
|
|
svc_port: <int>
|
|
* Determine the port used for Splunk management/remote API calls
|
|
* Default: 8089
|
|
|
|
appserver:
|
|
port: <int>
|
|
* Determine the port used for Splunk Application Server
|
|
* Default: 8065
|
|
|
|
kvstore:
|
|
port: <int>
|
|
* Determine the port used for Splunk Key-Value store
|
|
* Default: 8191
|
|
|
|
launch: null
|
|
* key::value pairs for environment variables that get written to ${SPLUNK_HOME}/etc/splunk-launch.conf
|
|
* Default: null
|
|
|
|
asan: <bool>
|
|
* Feature-flag to enable special configurations when using debug, address-sanitized builds. This is not used externally and not recommended to change.
|
|
* Default: false
|
|
|
|
connection_timeout: <int>
|
|
* Change timeout value (in seconds) for the setting `splunkdConnectionTimeout` in web.conf. This triggers a change only when the value is non-zero.
|
|
* Default: 0
|
|
|
|
secret: <str>
|
|
* Secret passcode used to encrypt all of Splunk's sensitive information on disk. When not set, Splunk will autogenerate a unique secret local to each installation. This is NOT required for any standalone or distributed Splunk topology
|
|
* NOTE: This may be set once at the start of provisioning any deployment. Any changes made to this splunk.secret after the deployment has been created must be resolved manually, otherwise there is a severe risk of bricking the capabilities of your Splunk environment.
|
|
* Default: null
|
|
|
|
pass4SymmKey: <str>
|
|
* Password for Symmetric Key used to encrypt Splunk's sensitive information on disk. When not set, Splunk will encrypt a default value (`changeme`) with `splunk.secret` and set it as `pass4SymmKey` in the `[general]` stanza of `/opt/splunk/etc/system/local/server.conf`.
|
|
* Default: null
|
|
|
|
ssl:
|
|
* Configure the default certificates used by Splunk Enterprise
|
|
|
|
enable: <bool>
|
|
* Enable SSL on the Splunkd management API (typically port 8089)
|
|
* Default: True
|
|
|
|
cert: <str>
|
|
* Specify the path to the SSL certificate used for the Splunkd management API
|
|
* Default: null
|
|
|
|
password <str>
|
|
* Specify the path to the SSL password used by the certificate above
|
|
* Default: null
|
|
|
|
ca: <str>
|
|
* Specify the path to the CA certificate used for the Splunkd management API
|
|
* Default: null
|
|
|
|
idxc:
|
|
label: <str>
|
|
* Provide a label for indexer clustering configuration
|
|
* Default: idxc_label
|
|
|
|
replication_factor: <int>
|
|
* Determine knowledge object replication factor
|
|
* Default: 3
|
|
|
|
replication_port: <int>
|
|
* Determine the port used for replication of artifacts
|
|
* Default: 9887
|
|
|
|
search_factor: <int>
|
|
* Determine the search factor used by indexer clustering
|
|
* Default: 3
|
|
|
|
secret: <str>
|
|
* Determine the secret used to configure indexer clustering. This is pass4SymmKey in the `[clustering]` stanza of server.conf.
|
|
* NOTE: This is being deprecated in favor of `splunk.idxc.pass4SymmKey`.
|
|
* Default: null
|
|
|
|
pass4SymmKey: <str>
|
|
* Determine the secret used to configure indexer clustering. This is REQUIRED when setting up indexer clustering. This is pass4SymmKey in the `[clustering]` stanza of server.conf.
|
|
* Default: null
|
|
|
|
discoveryPass4SymmKey: <str>
|
|
* Determine the secret used to enable indexer discovery (for any forwarding clients connecting to the cluster master). This is pass4SymmKey in the `[indexer_discovery]` stanza of server.conf.
|
|
* Default: null
|
|
|
|
multisite_master:
|
|
* Specify the location of the multisite cluster
|
|
* Default: null
|
|
|
|
multisite_master_port:
|
|
* Specify the management port of the multisite cluster master
|
|
* Default: 8089
|
|
|
|
multisite_replication_factor_origin:
|
|
* Determine origin-level knowledge object replication factor when in a multisite environment
|
|
* Default: 2
|
|
|
|
multisite_replication_factor_total:
|
|
* Determine site-level knowledge object replication factor when in a multisite environment
|
|
* Default: 3
|
|
|
|
multisite_search_factor_origin:
|
|
* Determine origin-level search replication factor when in a multisite environment
|
|
* Default: 1
|
|
|
|
multisite_search_factor_total:
|
|
* Determine site-level search replication factor when in a multisite environment
|
|
* Default: 3
|
|
|
|
site:
|
|
* Define the site of this particular Splunk Enterprise instance when in a multisite environment
|
|
* Default: null
|
|
|
|
all_sites:
|
|
* Define all sites of the topology when in a multisite environment
|
|
* Default: null
|
|
|
|
set_search_peers: <bool>
|
|
* Feature-flag to disable the automatic peering from the search tier to the indexer tier (cluster master or indexers directly). It is discouraged to change this to false, but it is exposed for the purposes of testing and isolating the groups.
|
|
* Default: true
|
|
|
|
shc:
|
|
label: <str>
|
|
* Provide a label for search head clustering configuration
|
|
* Default: shc_label
|
|
|
|
replication_factor: <int>
|
|
* Determine knowledge object replication factor
|
|
* Default: 3
|
|
|
|
replication_port: <int>
|
|
* Determine the port used for replication of artifacts
|
|
* Default: 9887
|
|
|
|
secret: <str>
|
|
* Determine the secret used to configure search head clustering. This is pass4SymmKey in server.conf.
|
|
* NOTE: This is being deprecated in favor of `splunk.shc.pass4SymmKey`
|
|
* Default: null
|
|
|
|
pass4SymmKey: <str>
|
|
* Determine the secret used to configure search head clustering. This is REQUIRED when setting up search head clustering. This is pass4SymmKey in the `[shclustering]` stanza of server.conf.
|
|
* Default: null
|
|
|
|
deployer_push_mode: <str>
|
|
* Change the strategy used by the deployer when bundling apps and distributing them across the search head cluster. The acceptable modes are: full, local_only, default_only, and merge_to_default (merge_to_default is the default unless otherwise specified).
|
|
* For more information, please see: https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges#Set_the_deployer_push_mode
|
|
* Default: null
|
|
|
|
dfs:
|
|
enable: <bool>
|
|
* Enable Data Fabric Search (DFS)
|
|
* Default: false
|
|
|
|
port: <int>
|
|
* Identifies the port on which the DFSMaster Java process runs.
|
|
* Default: 9000
|
|
|
|
dfc_num_slots: <int>
|
|
* Maximum number of concurrent DFS searches that run on each search head
|
|
* Default: 4
|
|
|
|
dfw_num_slots: <int>
|
|
* Maximum number of concurrent DFS searches that run on a search head cluster
|
|
* Default: 10
|
|
|
|
dfw_num_slots_enabled: <bool>
|
|
* Enables you to set the value of the field dfw_num_slots.
|
|
* Default: false
|
|
|
|
spark_master_host: <str>
|
|
* This setting identifies the Spark master.
|
|
* Default: 127.0.0.1
|
|
|
|
spark_master_webui_port: <int>
|
|
* Identifies the port for the Spark master web UI.
|
|
* Default: 8080
|
|
|
|
dsp:
|
|
enable: <bool>
|
|
* Enable Data Stream Procesor forwarding (DSP)
|
|
* Default: false
|
|
|
|
server: <str>
|
|
* DSP forwarding service endpoint
|
|
* Default: forwarders.scp.splunk.com:9997
|
|
|
|
cert: <str>
|
|
* Filepath to DSP forwarding client certificate - if set to 'auto', a new cert will be generated
|
|
* Default: null
|
|
|
|
verify: <bool>
|
|
* Enable server verification when forwarding
|
|
* Default: false
|
|
|
|
pipeline_name: <str>
|
|
* When configuring a new/existing DSP pipeline, the name of the pipeline
|
|
* Default: null
|
|
|
|
pipeline_desc: <str>
|
|
* When configuring a new/existing DSP pipeline, the description of the pipeline
|
|
* Default: null
|
|
|
|
pipeline_spec: <str>
|
|
* When configuring a new/existing DSP pipeline, the specification of the pipeline in SPL2 syntax
|
|
* Default: null
|
|
|
|
smartstore: <dict>
|
|
* Nested dict obj to enable automatic SmartStore provisioning
|
|
* Default: null
|
|
|
|
cachemanager: <dict>
|
|
* cachemanager server.conf settings related to SmartStore
|
|
* Default: null
|
|
* Example:
|
|
max_cache_size: 500
|
|
max_concurrent_uploads: 7
|
|
|
|
index: <list>
|
|
* Per-index SmartStore configuration
|
|
* Default: null
|
|
* Example:
|
|
- indexName: custom_index
|
|
remoteName: my_storage
|
|
scheme: http
|
|
remoteLocation: my_storage.net
|
|
s3:
|
|
access_key: <access_key>
|
|
secret_key: <secret_key>
|
|
endpoint: http://s3-us-west-1.amazonaws.com
|
|
maxGlobalDataSizeMB: 500
|
|
maxGlobalRawDataSizeMB: 200
|
|
hotlist_recency_secs: 30
|
|
hotlist_bloom_filter_recency_hours: 1
|
|
|
|
tar_dir: <str>
|
|
* Name of directory for the Splunk tar
|
|
* Default: splunk
|
|
|
|
# NOTE: This is the updated schema for this entry - please refer to "Configuration files" section for more info
|
|
conf: <list>
|
|
- key: <sttr - filename without .conf suffix)
|
|
value:
|
|
directory: <str - filepath>
|
|
* Path in filesystem to create `.conf` file
|
|
* Default: /opt/splunk/etc/system/local
|
|
|
|
content: <dict>
|
|
(section name): <dict>
|
|
(name) : (value)
|
|
* Key-value pairs in configuration file
|
|
```
|
|
|
|
### Configuration files
|
|
|
|
**Using this method of configuration file generation may not create a configuration file the way Splunk expects. Verify the generated configuration file to avoid errors. Use at your own discretion**
|
|
|
|
The `default.yml` file can be used to specify multiple named configuration files.
|
|
|
|
`conf` accepts an array of objects where each entry's key corresponds to the name of the `.conf` file and each entry's value contains a mapping of `directory` and `contents`. Files will be created in the directory specified in `directory` or the default directory (`/opt/splunk/etc/system/local`) if not provided. `content` accepts a dictionary where keys are section names and values are key-value pairs to be listed in the configuration file.
|
|
|
|
The following example generates `user-prefs.conf` in `/opt/splunk/etc/users/admin/user-prefs/local`
|
|
```
|
|
splunk:
|
|
conf:
|
|
- key: user-prefs
|
|
value:
|
|
directory: /opt/splunk/etc/users/admin/user-prefs/local
|
|
content:
|
|
general:
|
|
default_namespace : appboilerplate
|
|
search_use_advanced_editor : true
|
|
search_line_numbers : false
|
|
search_auto_format : false
|
|
search_syntax_highlighting : dark
|
|
```
|
|
|
|
```
|
|
[general]
|
|
default_namespace = appboilerplate
|
|
search_use_advanced_editor = true
|
|
search_line_numbers = false
|
|
search_auto_format = false
|
|
search_syntax_highlighting = dark
|
|
```
|
|
|
|
**NOTE:** The above `splunk.conf` was changed to accept an array data-type. This array input is only applicable for recent versions of `splunk-ansible`. If you are using any of the git-tagged versions `<= 8.0.2, <= 7.3.5, <= 7.2.9` (which directly map to any of the Docker-based `splunk/splunk` images), you must use the former dictionary data-type. An example of this is shown below:
|
|
```
|
|
splunk:
|
|
conf:
|
|
user-prefs:
|
|
directory: /opt/splunk/etc/users/admin/user-prefs/local
|
|
content:
|
|
general:
|
|
default_namespace : appboilerplate
|
|
search_use_advanced_editor : true
|
|
search_line_numbers : false
|
|
search_auto_format : false
|
|
search_syntax_highlighting : dark
|
|
```
|
|
|
|
Any recent versions of `splunk-ansible` should still support this map type, however it is strongly recommended you move to the array type for future support.
|
|
|
|
---
|
|
|
|
## Example
|
|
|
|
The following is used in the quickstart section to start Splunk in a standalone mode, using the Splunk installation provided in /tmp/splunk.tgz
|
|
|
|
```
|
|
---
|
|
ansible_post_tasks: null
|
|
ansible_pre_tasks: null
|
|
hide_password: false
|
|
retry_delay: 3
|
|
retry_num: 60
|
|
wait_for_splunk_retry_num: 60
|
|
shc_sync_retry_num: 60
|
|
splunk_home_ownership_enforcement: true
|
|
|
|
config:
|
|
baked: default.yml
|
|
defaults_dir: /tmp/defaults
|
|
env:
|
|
headers: null
|
|
var: SPLUNK_DEFAULTS_URL
|
|
verify: true
|
|
host:
|
|
headers: null
|
|
url: null
|
|
verify: true
|
|
max_delay: 60
|
|
max_retries: 3
|
|
max_timeout: 1200
|
|
|
|
splunk:
|
|
role: splunk_standalone
|
|
upgrade: false
|
|
build_location: /tmp/splunk.tgz
|
|
apps_location: null
|
|
license_uri: null
|
|
admin_user: admin
|
|
app_paths:
|
|
default: /opt/splunk/etc/apps
|
|
deployment: /opt/splunk/etc/deployment-apps
|
|
httpinput: /opt/splunk/etc/apps/splunk_httpinput
|
|
idxc: /opt/splunk/etc/master-apps
|
|
shc: /opt/splunk/etc/shcluster/apps
|
|
enable_service: false
|
|
exec: /opt/splunk/bin/splunk
|
|
group: splunk
|
|
hec:
|
|
enable: True
|
|
ssl: True
|
|
port: 8088
|
|
token: 4a8a737d-5452-426c-a6f7-106dca4e813f
|
|
home: /opt/splunk
|
|
http_enableSSL: 0
|
|
http_enableSSL_cert: null
|
|
http_enableSSL_privKey: null
|
|
http_enableSSL_privKey_password: null
|
|
http_port: 8000
|
|
idxc:
|
|
enable: false
|
|
label: idxc_label
|
|
replication_factor: 3
|
|
replication_port: 9887
|
|
search_factor: 3
|
|
secret: dmwHG97SpM+GzeGPUELwr7xXowSAVmLW
|
|
ignore_license: false
|
|
license_download_dest: /tmp/splunk.lic
|
|
opt: /opt
|
|
password: helloworld
|
|
pid: /opt/splunk/var/run/splunk/splunkd.pid
|
|
s2s_enable: true
|
|
s2s_port: 9997
|
|
search_head_captain_url: null
|
|
secret: null
|
|
shc:
|
|
enable: false
|
|
label: shc_label
|
|
replication_factor: 3
|
|
replication_port: 9887
|
|
secret: EpcUlTUHMSOhdjRZb3QqPYf9Lf7L991c
|
|
smartstore: null
|
|
svc_port: 8089
|
|
tar_dir: splunk
|
|
user: splunk
|
|
wildcard_license: false
|
|
```
|