Hi Vince,
To do that you will need to populate the
https://github.com/puppetlabs/puppetlabs-splunk/blob/master/manifests/forwarder.pp
forwarder_input parameter. The title won't matter so you can have 3
different titles pointing to a splunkforwarder_input parameter section.
Section is defined in each hash as below:
You will need to say something like
class { 'splunk::forwarder' :
forwarder_input => {
'nginx' =>{
section => 'monitor:///var/log/nginx',
setting => 'disabled',
value => 'false',
},
'nginx_sourcetype' => {
section => 'monitor:///var/log/nginx',
setting => 'sourcetype',
value => 'nginx'},
'nginx_input' => {
section => 'monitor:///var/log/nginx',
setting => 'index',
value => 'main'
}
}
}
Let me know if this helps.
On Tuesday, 28 July 2015 18:31:24 UTC+1, Vince Skahan wrote:
>
> Does anybody actually use the puppetlabs-splunk module ?
>
> I've been battling this for too many hours and have a bunch of questions.
> I can't really find any references via Google that this is getting much
> usage, and the documentation in the module itself seems essentially
> non-existent, but I thought I'd ask just in case:
>
> - how do you define a section for inputs.conf that has multiple
> key=value pairs
>
> If I wanted a inputs.conf stanza of the following, how do I make that
> happen ?
>
> [monitor:///var/log/nginx]
> disabled = false
> index = main
> sourcetype = nginx
>
>
> I came up with the following, but the problem is it only permits
> 'one' setting and value.....
>
> splunkforwarder_input { 'nginx':
> section => 'monitor:///var/log/nginx',
> setting => 'disabled'
> value => 'false',
> }
>
> Is there a way to get it to accept multiple free-form multiple key=value
> pairs ? It's using their ini module under the hood isn't it ? Is there a
> secret decoder ring of examples someplace ?
>
>
> - the README file seems totally wrong to me. On a centos6 system, it
> doesn't try to install the universal forwarder rpm from the source tree it
> tells you to build, and it doesn't use the version/build info it tells you
> to put into parameters. It does a 'yum install splunkforwarder' with odd
> options, and no (visible to me) way to control yum options, which repo(s)
> are enabled/disabled, etc. While the installation 'does' work and it
> enables and starts the process well, the whole thing seems like half a
> solution with a tenth of the docs that I'd expect a 'supported' module to
> have.
>
> FWIW, I only figured out what was expected by reading the (minimal) tests
> in the module sources. I'd have expected some examples/readme files to
> save hundreds of potential users that pain.
>
>
> class { 'splunk::params':
> version => '6.1.2',
> build => '213098',
> server => 'splunk.apps.oris.washington.edu',
> }
> class { 'splunk::forwarder' :
>
> }
>
>
> Am I missing something in how to decipher this thing ? Should we have to
> spend hours trying to reverse engineer a basically undocumented module that
> doesn't even really say what it does/doesn't support in terms of
> functionality or should we just shop elsewhere or roll our own ? Guess I'm
> pretty lost/confused/tired of battling this thing. Ideas ?
>
>
>
>
>
>
>
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/fd80c1ed-b979-4c7e-bff4-5a2b83444d08%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
