Issue when running the splunk module for the first time

Question

Issue when running the splunk module for the first time

triceras opened this issue 11 years ago · comments

Hi Aleassandro,

I am running your puppet module for splunk and I am getting an error related to some misconfiguration on the ERB template "add_forward_server.erb". The error message I am getting when running the puppet agent is the following:

?Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Failed to parse template splunk/add_forward_server.erb:
Filepath: /etc/puppetlabs/puppet/modules/splunk/templates/add_forward_server.erb
Line: 5
Detail: undefined method `each' for "lxexhindladev81.pexa:9997":String
at /etc/puppetlabs/puppet/modules/splunk/manifests/init.pp:397 on node bat02-shr.pexa
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run"

My site.pp is the following:

class { "splunk" :
install => "forwarder",
forward_server => "lxexhindladev81.pexa:9997",
install_source => "/pexa/SOE_applicator/general/splunk/splunk-5.0.1-143156-Linux-x86_64.tgz",
disable => false,
}

The ERB template content is:

!/bin/sh

File Managed by Puppet

Adding forward servers

<% @forward_server.each do |fs| -%>
<%= scope.lookupvar('splunk::basedir') %>/bin/splunk add forward-server <%= fs %> --accept-license --answer-yes --auto-ports --no-prompt -auth admin:<%= scope.lookupvar('splunk::admin_password') %>
<% end -%>

Service restart (done here to skip Puppet dependencies hell)

/etc/init.d/splunk restart

Please let me know if you need any further information. I can provide you with the manifest files if you require.

Thanks,

Rafael

Alessandro Franceschi commented 10 years ago

good

Alessandro Franceschi · Answer 1 · Tue Apr 15 2014 14:09:33 GMT+0800 (China Standard Time)

try to pass forward_server as an array:
class { "splunk" :
install => "forwarder",
forward_server => ["lxexhindladev81.pexa:9997"],
install_source => "/pexa/SOE_applicator/general/splunk/splunk-5.0.1-143156-Linux-x86_64.tgz",
disable => false,
}

triceras · Answer 2 · Wed Apr 16 2014 07:39:46 GMT+0800 (China Standard Time)

HI Alessandro,

The issue is with a missing brackets in the ERB template. After I added
the brackets in between "@forward_server" the puppet agent did not comply
about the template any more. I recommend you to test this modification and
apply the changes if you find necessary.

more add_forward_server.erb

#!/bin/sh

File Managed by Puppet

Adding forward servers

<% *[@forward_server].each do |fs| *-%>
<%= scope.lookupvar('splunk::basedir') %>/bin/splunk add forward-server <%=
fs %> --accept-lice
nse --answer-yes --auto-ports --no-prompt -auth admin:<%=
scope.lookupvar('splunk::admin_passwo
rd') %>
<% end -%>

Service restart (done here to skip Puppet dependencies hell)

/etc/init.d/splunk restart
mgt01-shr:root [6]

I also would like to ask you how can I generate the inputs.conf using the
"template_inputs" variable as a hash in the site.pp file ??

COuld you please give me an example how I can use the variable
"template_inputs" to call the inputs.conf.erb and then populate with some
values such as:

     # inputs.conf
     [monitor:///var/log/messages]

disabled = false
followTail = 0
host = mgt01-shr
index = dev
sourcetype = syslog

    The configuration that I currently have in place is the following:

site.pp

class { "splunk" :
install => "forwarder",
forward_server => "lxexhindladev81:9997",
#monitor_path => ["/var/log/messages" , "var/log/secure"],
template_inputs => "splunk_outputs.conf.erb",
}

      ## init.pp variable description

[template_outputs]

A custom template to use for a custom etc/system/local/outputs.conf file

The value is used in: content => template($template_outputs),

Note that splunk generates autonomously this file and on the forwarder

this is populated with the value of forward_server

I look forward to hearing from you soon.

Best Regards,

Rafael

2014-04-15 16:09 GMT+10:00 Alessandro Franceschi notifications@github.com:

try to pass forward_server as an array:
class { "splunk" :
install => "forwarder",
forward_server => ["lxexhindladev81.pexa:9997"],
install_source =>
"/pexa/SOE_applicator/general/splunk/splunk-5.0.1-143156-Linux-x86_64.tgz",
disable => false,
}

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/13#issuecomment-40448874
.

triceras · Answer 3 · Wed Apr 16 2014 11:49:05 GMT+0800 (China Standard Time)

On teh same matter...

How can I use the "input::monitor" class inside the site.pp where I
wwould like to specify the parameters for this class...

Rafael

2014-04-16 9:39 GMT+10:00 Rafael Abdalla triceras@gmail.com:

HI Alessandro,

The issue is with a missing brackets in the ERB template. After I added
the brackets in between "@forward_server" the puppet agent did not comply
about the template any more. I recommend you to test this modification and
apply the changes if you find necessary.

more add_forward_server.erb

#!/bin/sh

File Managed by Puppet

Adding forward servers

<% *[@forward_server].each do |fs| *-%>
<%= scope.lookupvar('splunk::basedir') %>/bin/splunk add forward-server
<%= fs %> --accept-lice
nse --answer-yes --auto-ports --no-prompt -auth admin:<%=
scope.lookupvar('splunk::admin_passwo
rd') %>
<% end -%>

Service restart (done here to skip Puppet dependencies hell)

/etc/init.d/splunk restart
mgt01-shr:root [6]

I also would like to ask you how can I generate the inputs.conf using the
"template_inputs" variable as a hash in the site.pp file ??

COuld you please give me an example how I can use the variable
"template_inputs" to call the inputs.conf.erb and then populate with some
values such as:
     # inputs.conf
     [monitor:///var/log/messages]
disabled = false
followTail = 0
host = mgt01-shr
index = dev
sourcetype = syslog
    The configuration that I currently have in place is the following:
site.pp

class { "splunk" :
install => "forwarder",
forward_server => "lxexhindladev81:9997",
#monitor_path => ["/var/log/messages" , "var/log/secure"],
template_inputs => "splunk_outputs.conf.erb",
}
      ## init.pp variable description
[template_outputs]

A custom template to use for a custom etc/system/local/outputs.conf file

The value is used in: content => template($template_outputs),

Note that splunk generates autonomously this file and on the forwarder

this is populated with the value of forward_server

I look forward to hearing from you soon.

Best Regards,

Rafael

2014-04-15 16:09 GMT+10:00 Alessandro Franceschi <notifications@github.com

:

try to pass forward_server as an array:

class { "splunk" :
install => "forwarder",
forward_server => ["lxexhindladev81.pexa:9997"],
install_source =>
"/pexa/SOE_applicator/general/splunk/splunk-5.0.1-143156-Linux-x86_64.tgz",
disable => false,
}

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/13#issuecomment-40448874
.

Alex Trepca · Answer 4 · Thu Jul 17 2014 00:19:54 GMT+0800 (China Standard Time)

Got the same error when RSpec testing a class that included the splunk class:

Detail: undefined method `each' for "splunk_indexer:port":String

Passing forward_server as an array fixed it:

forward_server => [ 'splunk_indexer:port', ],

I submitted a pull request that updates README.md so people know to set that as an array.

Alessandro Franceschi · Answer 5 · Thu Jul 17 2014 04:40:52 GMT+0800 (China Standard Time)

+1, thanks

Alex Trepca · Answer 6 · Thu Jul 17 2014 11:04:43 GMT+0800 (China Standard Time)

Thanks! I guess this issue can be marked as closed.