puppet-splunk icon indicating copy to clipboard operation
puppet-splunk copied to clipboard

Default inputs.conf configuration does not work with clustered indexers

Open rbclark opened this issue 6 years ago • 0 comments

Affected Puppet, Ruby, OS and module versions/distributions

  • Puppet: 4.10.12
  • Ruby: ruby 2.0.0p648
  • Distribution: Centos 7.6
  • Module version: latest (5b480907ee4bc277f2f930eb60e6babb0a17a7c5)

How to reproduce (e.g Puppet code you use)

Setup splunk with multiple indexers and a cluster master. Then setup a forwarder to send data to it.

What are you seeing

ERROR IndexerDiscoveryHeartbeatThread - failed to parse response payload for group=<group>, error=failed to extract FwdTarget from json node={"hostport":"?","ssl":false,"indexing_disk_space":-1}http_response=OK

What behaviour did you expect instead

A successful forwarding of data to the Splunk cluster.

Any additional information you'd like to impart

I tracked the issue down the the fact that (as described here) this module sets up [splunktcp://:9997] and not [splunktcp://9997] by default. By changing https://github.com/voxpupuli/puppet-splunk/blob/4fe1532433d406df26bd66d819da10c5c6373aa2/manifests/init.pp#L143 to not have the 2nd : this issue would not happen. I have no problem putting in a PR making this small change however I want to make sure this is desired by more than just me before making the change.

rbclark avatar Mar 06 '19 21:03 rbclark