Issue when running the splunk module for the first time

[triceras]

Hi Aleassandro,

I am running your puppet module for splunk and I am getting an error related to some misconfiguration on the ERB template "add_forward_server.erb". The error message I am getting when running the puppet agent is the following:

?Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Failed to parse template splunk/add_forward_server.erb: Filepath: /etc/puppetlabs/puppet/modules/splunk/templates/add_forward_server.erb Line: 5 Detail: undefined method `each' for "lxexhindladev81.pexa:9997":String at /etc/puppetlabs/puppet/modules/splunk/manifests/init.pp:397 on node bat02-shr.pexa Warning: Not using cache on failed catalog Error: Could not retrieve catalog; skipping run"

My site.pp is the following:

class { "splunk" : install => "forwarder", forward_server => "lxexhindladev81.pexa:9997", install_source => "/pexa/SOE_applicator/general/splunk/splunk-5.0.1-143156-Linux-x86_64.tgz", disable => false, }

The ERB template content is:

!/bin/sh

File Managed by Puppet

Adding forward servers

<% @forward_server.each do |fs| -%> <%= scope.lookupvar('splunk::basedir') %>/bin/splunk add forward-server <%= fs %> --accept-license --answer-yes --auto-ports --no-prompt -auth admin:<%= scope.lookupvar('splunk::admin_password') %> <% end -%>

Service restart (done here to skip Puppet dependencies hell)

/etc/init.d/splunk restart

Please let me know if you need any further information. I can provide you with the manifest files if you require.

Thanks,

Rafael

[alvagante]

try to pass forward_server as an array: class { "splunk" : install => "forwarder", forward_server => ["lxexhindladev81.pexa:9997"], install_source => "/pexa/SOE_applicator/general/splunk/splunk-5.0.1-143156-Linux-x86_64.tgz", disable => false, }

[triceras]

HI Alessandro,

The issue is with a missing brackets in the ERB template. After I added the brackets in between "@forward_server" the puppet agent did not comply about the template any more. I recommend you to test this modification and apply the changes if you find necessary.

more add_forward_server.erb

!/bin/sh

File Managed by Puppet

Adding forward servers

<% [@forward_server].each do |fs| -%> <%= scope.lookupvar('splunk::basedir') %>/bin/splunk add forward-server <%= fs %> --accept-lice nse --answer-yes --auto-ports --no-prompt -auth admin:<%= scope.lookupvar('splunk::admin_passwo rd') %> <% end -%>

Service restart (done here to skip Puppet dependencies hell)

/etc/init.d/splunk restart mgt01-shr:root [6]

I also would like to ask you how can I generate the inputs.conf using the "template_inputs" variable as a hash in the site.pp file ??

COuld you please give me an example how I can use the variable "template_inputs" to call the inputs.conf.erb and then populate with some values such as:

     # inputs.conf
     [monitor:///var/log/messages]

disabled = false followTail = 0 host = mgt01-shr index = dev sourcetype = syslog

    The configuration that I currently have in place is the following:

site.pp

class { "splunk" : install => "forwarder", forward_server => "lxexhindladev81:9997",

monitor_path => ["/var/log/messages" , "var/log/secure"],

template_inputs => "splunk_outputs.conf.erb",

}

      ## init.pp variable description

[_templateoutputs]

A custom template to use for a custom etc/system/local/outputs.conf file

The value is used in: content => template($template_outputs),

Note that splunk generates autonomously this file and on the forwarder

this is populated with the value of forward_server

I look forward to hearing from you soon.

Best Regards,

Rafael

2014-04-15 16:09 GMT+10:00 Alessandro Franceschi notifications@github.com:

try to pass forward_server as an array: class { "splunk" : install => "forwarder", forward_server => ["lxexhindladev81.pexa:9997"], install_source => "/pexa/SOE_applicator/general/splunk/splunk-5.0.1-143156-Linux-x86_64.tgz", disable => false, }

— Reply to this email directly or view it on GitHubhttps://github.com/example42/puppet-splunk/issues/13#issuecomment-40448874 .

[triceras]

On teh same matter...

How can I use the "input::monitor" class inside the site.pp where I wwould like to specify the parameters for this class...

Rafael

2014-04-16 9:39 GMT+10:00 Rafael Abdalla triceras@gmail.com:

HI Alessandro,

The issue is with a missing brackets in the ERB template. After I added the brackets in between "@forward_server" the puppet agent did not comply about the template any more. I recommend you to test this modification and apply the changes if you find necessary.

more add_forward_server.erb

!/bin/sh

File Managed by Puppet

Adding forward servers

<% [@forward_server].each do |fs| -%> <%= scope.lookupvar('splunk::basedir') %>/bin/splunk add forward-server <%= fs %> --accept-lice nse --answer-yes --auto-ports --no-prompt -auth admin:<%= scope.lookupvar('splunk::admin_passwo rd') %> <% end -%>

Service restart (done here to skip Puppet dependencies hell)

/etc/init.d/splunk restart mgt01-shr:root [6]

I also would like to ask you how can I generate the inputs.conf using the "template_inputs" variable as a hash in the site.pp file ??

COuld you please give me an example how I can use the variable "template_inputs" to call the inputs.conf.erb and then populate with some values such as:

     # inputs.conf
     [monitor:///var/log/messages]

disabled = false followTail = 0 host = mgt01-shr index = dev sourcetype = syslog

    The configuration that I currently have in place is the following:

site.pp

class { "splunk" : install => "forwarder", forward_server => "lxexhindladev81:9997",

monitor_path => ["/var/log/messages" , "var/log/secure"],

template_inputs => "splunk_outputs.conf.erb",

}

      ## init.pp variable description

[_templateoutputs]

A custom template to use for a custom etc/system/local/outputs.conf file

The value is used in: content => template($template_outputs),

Note that splunk generates autonomously this file and on the forwarder

this is populated with the value of forward_server

I look forward to hearing from you soon.

Best Regards,

Rafael

2014-04-15 16:09 GMT+10:00 Alessandro Franceschi <notifications@github.com

:

try to pass forward_server as an array:

class { "splunk" : install => "forwarder", forward_server => ["lxexhindladev81.pexa:9997"], install_source => "/pexa/SOE_applicator/general/splunk/splunk-5.0.1-143156-Linux-x86_64.tgz", disable => false, }

— Reply to this email directly or view it on GitHubhttps://github.com/example42/puppet-splunk/issues/13#issuecomment-40448874 .

[atrepca]

Got the same error when RSpec testing a class that included the splunk class:

Detail: undefined method `each' for "splunk_indexer:port":String

Passing forward_server as an array fixed it:

forward_server => [ 'splunk_indexer:port', ],

I submitted a pull request that updates README.md so people know to set that as an array.

[alvagante]

+1, thanks

[atrepca]

Thanks! I guess this issue can be marked as closed.

[alvagante]

good