Ask Your Question

Custom SplunkForwarder module

asked 2015-02-27 11:09:40 -0600

qwerty_face gravatar image

OK so I have a module that I have written myself to deploy the splunkforwarder module on a CentOS/RHEL system. I only started to pick Puppet up as a tool a few weeks ago and so I am by all means a novice.

The module install's the splunkforwarder rpm file from a local repo (already handled prior). The ensure parameter is set to latest so as you'd expect each time puppet runs on the agent node it will upgrade the previous version of the splunkforwarder if a later rpm is present in the repo. The first installation is going OK. However, the module faults when upgrading. My problem is that I don't know how to program the relationships between which stanzas. Specifically, before upgrading I want to execute a command to:

  1. check that there is a previous installation
  2. if there's a currently running splunk service, then stop it.
  3. upgrade the software, then go through the usual splunk start --accept-license --answer-yes and splunk enable boot-start after applying my own output.conf file from the puppet master.

I am aware that there is already a module over at the forge, but I'd like to write my own for my own local purposes.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2015-02-28 14:19:13 -0600

doc75 gravatar image

If there is already a module for this, you should have a loot at how this module handle the case interesting for you. I did this on a lot of modules and this is often a very good way to learn more on puppet.

edit flag offensive delete link more

answered 2015-03-08 12:09:14 -0600

rnelson0 gravatar image

If there is already a forge module, investigate whether or not it can be enhanced - either through some extra options that already exist, or via submitting pull requests to the maintainer - rather than recreating the wheel. You will lose out on lack of testing and use cases from a public module.

As for the upgrade process, are you building the splunk rpm on your own or using the vendor provided one? The rpm should have pre-uninstall and post-install scripts that stop existing services and start the upgraded services, respectively. As long as the RPM is built properly with this, you should use the file/package/service pattern where you deploy your output.conf file, upgrade the package, and start the service. This is a simplication, but try something like this:

file {'output.conf:
  ensure => present,
  path   => '/path/to/output.conf',
} ->
package {'splunk':
  ensure => latest,
} ->
service {'splunk':
  ensure => running,

Also, I would suggest specifying a specific version of the package rather than 'latest'. It has been suggested that 'latest' have an alias of 'yolo' as you can hopefully imagine the destruction it could cause. You can use automatic parameter lookup in your profile class and hiera to make upgrading the version very easy.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2015-02-27 11:07:06 -0600

Seen: 572 times

Last updated: Mar 08 '15