search

voxpupuli / puppet-splunk

Manage Splunk servers and forwarders using Puppet
https://forge.puppet.com/puppet/splunk
Apache License 2.0
40 stars 121 forks source link

default location of splunk.secret is wrong? #324

Closed martijndegouw closed 2 weeks ago

martijndegouw commented 2 years ago

Affected Puppet, Ruby, OS and module versions/distributions

How to reproduce (e.g Puppet code you use)

What are you seeing

I noticed that in params.pp the secret file location is set to '${homedir}/etc/splunk.secret'.

What behaviour did you expect instead

In our instances the splunk.secret file is in ${homedir}/etc/auth/. Also in splunk::enterprise::service::nix the /etc/auth/splunk.secret is used as hard-coded location for the exec creates.

Output log

Any additional information you'd like to impart

I was wondering if this default is correct, and, if yes, which magic I'm missing here. If the default location is indeed incorrect I can supply a patch for this.

jacobevanstmx commented 2 years ago

Both of my environments have it at ${homedir}/etc/auth/splunk.secret as you suggest.

Forwarder installed by Puppet: VERSION=8.2.2 BUILD=87344edfcdb4 PRODUCT=splunk PLATFORM=Linux-x86_64

Enterprise never touched by Puppet: VERSION=8.1.4 BUILD=17f862b42a7c PRODUCT=splunk PLATFORM=Linux-x86_64

martijndegouw commented 2 years ago

The oldest version I was able to check for the splunk.secret location is version 6.3.14. This version already has this file in etc/auth.

luedderd commented 3 weeks ago

Looking through Splunk's official documentation from 7.0.0-9.3.0, the location for the splunk.secret file should be $SPLUNK_HOME/etc/auth.