With the Splunk Hec module you can send Puppet report and inventory data to Splunk for analysis. Install the module on your Puppet master and configure a complementary Splunkbase app called the Puppet Report Viewer. Once installed and populated with data, the Puppet Report Viewer looks something like the dashboard below.

2. Create an HEC token in Splunk

1. Navigate to Settings > Data Input in your Splunk console.
2. Enable HEC if not already enabled:
   1. Click HTTP Event Collector.
   2. Click Global Settings.
   3. In the All Tokens toggle button, select Enabled.
   4. Click Save.
3. Add a new HTTP Event Collector with a name of your choice.
4. Ensure indexer acknowledgement is not enabled.
5. Click Next and select the puppet:summary source type located under the Puppet Data category.
6. Ensure the App Context is set to Puppet Report Viewer.
7. Select the main index.
8. Set the Default Index to main.
9. Click Review and then Submit.

When editing your new token, it should look similar to the screenshot below.

3. Add the class splunk_hec to the PE Master node group

1. Install the splunk_hec module on your Puppet master by running $ puppet module install puppetlabs-splunk_hec --version 0.7.1
2. In the PE console, navigate to Classification and expand the PE Infrastructure group.
3. Select PE Master and then Configuration.
4. Add the splunk_hec class.
5. Enable these parameters:

   enable_reports = true
   manage_routes = true
   token = something like F5129FC8-7272-442B-983C-203F013C1948
   url = something like https://splunk-8.splunk.internal:8088/services/collector
   

6. Click Add parameter and commit your changes.
7. Run Puppet on the node group. This restarts the Puppet Server service.

4. Log into the Splunk Console

Search index=* sourcetype=puppet:summary and if everything was done properly, you should see the reports (and soon facts) from the systems in your Puppet environment.

Want to know more?

There are many additional ways to configure the Splunk Hec module not covered in these instructions, such as only sending Puppet data to Splunk for failed Puppet runs. These topics are covered in the Splunk Hec README. In addition, PE users can install the Puppet Alert Actions app and trigger Bolt tasks and more based on Puppet data in Splunk.