Wanted: Ability to configure splunkforwarding to non-chef managed server about chef-splunk HOT 14 CLOSED

I was just about to open the same issue.
Please add an attribute for unmanaged splunk server.

from chef-splunk.

I think this would be best implemented using a method that defines an interface to the required "splunk server" data, ipaddress:port, per the current implementation in outputs.conf's "server" directive.

At a highlevel, I think we'd have a method, #splunk_server_lookup in the cookbook's libraries.

params

lookup_type: the value is a String, an Array, or a Chef::Node::Attribute.

If it is a String, assume this is a search query to perform.

If it is an Array, assume this is a data bag name, and a data bag item to load, which adheres to a specific JSON structure.

If it is a Chef::Node::Attribute, assume it contains a value of another Chef attribute on the node to look up to use as the value.

We would set an attribute, node['splunk']['server_lookup'] that contains the parameter to send to this method, defaulting to the current search query to maintain compatibility.

node.default['splunk']['server_lookup'] = "splunk_is_server:true AND chef_environment:#{node.chef_environment}"

To specify a data bag and item, set the attribute in your favorite place (like a role, or a "wrapper" cookbook)

node.default['splunk']['server_lookup'] = ['splunk', 'servers']

Or, to set another attribute to look up:

node.default['splunk']['server_lookup'] = Chef::Node::ImmutableMash.new({'attrib' => 'my_splunk'})

This would likely have to be set in a cookbook, since making this supported in roles/environments that are JSON would be really awkward.

returns

A sorted Array of "ipaddress:port" strings. For example:

=> ["10.11.12.100:9997"]
=> ["10.11.12.100:9997", "192.168.77.88:8000"]

The results should be sorted, uniq, compacted, and flattened.

from chef-splunk.

@ampledata Thoughts?

from chef-splunk.

I like it, it works, and maintains compat and adds some awesome new abilities. You've got your work cut out for you! 👍

from chef-splunk.

Fwiw, I don't have cycles to add this functionality any time soon.

from chef-splunk.

I'll be happy to take a swing at this.

from chef-splunk.

@ampledata , @jtimberman and @hrez - Would appreciate your feedback on initial work: trumant@251072c

Still working on getting test kitchen tests rounded out to prove that data bag and node attribute configuration works.

from chef-splunk.

@jtimberman @trumant Any update on implementing this? +1 on it being hugely beneficial.

from chef-splunk.

@thomasbiddle - I didn't end up taking it any further because I ended up replacing my usage of this cookbook with an Ansible role as part of a broader move to Ansible.

from chef-splunk.

There is a simple way of doing this, add an attribute and if the server search returns nil, set the servers based on the values in the attribute.

from chef-splunk.

+1. this would be beneficial for people using 'Splunk Cloud'

from chef-splunk.

This could also be done by defining the outputs.conf in an app bundle and then using the splunk_app resource.

from chef-splunk.

#54 has a solution to this, but we need additional testing before it can be merged.

from chef-splunk.

Fixed with #93 . Closing.

from chef-splunk.