puppet-splunk
puppet-splunk copied to clipboard
Default inputs.conf configuration does not work with clustered indexers
Affected Puppet, Ruby, OS and module versions/distributions
- Puppet: 4.10.12
- Ruby: ruby 2.0.0p648
- Distribution: Centos 7.6
- Module version: latest (5b480907ee4bc277f2f930eb60e6babb0a17a7c5)
How to reproduce (e.g Puppet code you use)
Setup splunk with multiple indexers and a cluster master. Then setup a forwarder to send data to it.
What are you seeing
ERROR IndexerDiscoveryHeartbeatThread - failed to parse response payload for group=<group>, error=failed to extract FwdTarget from json node={"hostport":"?","ssl":false,"indexing_disk_space":-1}http_response=OK
What behaviour did you expect instead
A successful forwarding of data to the Splunk cluster.
Any additional information you'd like to impart
I tracked the issue down the the fact that (as described here) this module sets up [splunktcp://:9997] and not [splunktcp://9997] by default. By changing https://github.com/voxpupuli/puppet-splunk/blob/4fe1532433d406df26bd66d819da10c5c6373aa2/manifests/init.pp#L143 to not have the 2nd : this issue would not happen. I have no problem putting in a PR making this small change however I want to make sure this is desired by more than just me before making the change.