Puppet Class: splunk::outputs

Defined in:
manifests/outputs.pp

Overview

splunk::outputs should be called to manage your splunk outputs.conf by default outputs.conf will be placed in $splunkhome/etc/system/local/

Parameters

output_hash

Optional hash of outputs that can be used instead of, or in addition to the default group (tcpout) Useful for forwarding data to third party tools from indexers.

output_hash => { ‘syslog:example_group’ => {

    'server' => 'server.example.com:514' }
}
port

port to send data to. Defaults to 9997

path

Path to outputs.conf file to be managed

tcpout_disabled

Enable global forwarding. Defaults to False, which enables Global fowarding. On Indexers this will probably be set to “True” to disable forwarding of all inputs.

target_group

Hash used to define splunk default groups and servers, valid configs are { ‘target group name’ => ‘server/ip’ }

For more info on outputs.conf docs.splunk.com/Documentation/Splunk/latest/admin/Outputsconf

Parameters:

  • indexandforward (Any) (defaults to: $::splunk::indexandforward)
  • output_hash (Any) (defaults to: $::splunk::output_hash)
  • port (Any) (defaults to: $::splunk::port)
  • path (Any) (defaults to: "${::splunk::splunkhome}/etc/system/local")
  • tcpout_disabled (Any) (defaults to: false)
  • target_group (Any) (defaults to: $::splunk::target_group) 


29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
 
# File 'manifests/outputs.pp', line 29

class splunk::outputs (
  $indexandforward = $::splunk::indexandforward,
  $output_hash     = $::splunk::output_hash,
  $port            = $::splunk::port,
  $path            = "${::splunk::splunkhome}/etc/system/local",
  $tcpout_disabled = false,
  $target_group    = $::splunk::target_group
  ) {

  # Check if tcpout_disabled is a string
  if is_string($tcpout_disabled){
    warning( 'WARNING: $tcpout_disabled is a string and should be a boolean!' )
    notify{ 'WARNING: $tcpout_disabled is a string and should be a boolean!': }
    notify{ '$tcpout_disabled will break in the next version of the module': }
  }
  # Check if indexandforward is a string
  if is_string($indexandforward){
    warning( 'WARNING: $indexandforward is a string and should be a boolean!' )
    notify{ 'WARNING: $indexandforward is a string and should be a boolean!': }
    notify{ '$indexandforward will break in the next version of the module': }
  }

  # Validate target group hash
  if !is_hash($target_group){
    fail('target_group is not a valid hash')
  }
  $groupkeys    = keys($target_group)
  $sorted       = sort($groupkeys)
  $defaultgroup = join($sorted, ',')

  # Validate outputs hash
  if ( $output_hash ) {
    if !is_hash($output_hash){
      fail("${output_hash} is not a valid hash")
    }
  }
  $output_title = keys($output_hash)



  file { "${path}/outputs.conf":
    ensure  => file,
    owner   => 'splunk',
    group   => 'splunk',
    mode    => '0644',
    backup  => true,
    content => template('splunk/opt/splunk/etc/system/local/outputs.conf.erb'),
    notify  => Class['splunk::service']
  }
}