Getting started with PE and Splunk
With the Splunk Hec module you can send Puppet report and inventory data to Splunk for analysis. Install the module on your Puppet master and configure a complementary Splunkbase app called the Puppet Report Viewer. Once installed and populated with data, the Puppet Report Viewer looks something like the dashboard below.
Before you begin
- Install Puppet Enterprise >= 2019.5
- Install Splunk Enterprise
- Install Puppet Report Viewer
2. Create an HEC token in Splunk
- Navigate to
Data Inputin your Splunk console.
- Enable HEC if not already enabled:
- Click HTTP Event Collector.
- Click Global Settings.
- In the All Tokens toggle button, select Enabled.
- Click Save.
- Add a new
HTTP Event Collectorwith a name of your choice.
indexer acknowledgementis not enabled.
- Click Next and select the
puppet:summarysource type located under the Puppet Data category.
- Ensure the
App Contextis set to
Puppet Report Viewer.
- Select the
- Set the Default Index to
- Click Review and then Submit.
When editing your new token, it should look similar to the screenshot below.
3. Add the class
splunk_hec to the PE Master node group
- Install the
splunk_hecmodule on your Puppet master by running
$ puppet module install puppetlabs-splunk_hec --version 0.7.1
- In the PE console, navigate to
Classificationand expand the
PE Masterand then
- Add the
- Enable these parameters:
enable_reports = true manage_routes = true token = something like F5129FC8-7272-442B-983C-203F013C1948 url = something like https://splunk-8.splunk.internal:8088/services/collector
- Click Add parameter and commit your changes.
- Run Puppet on the node group. This restarts the Puppet Server service.
4. Log into the Splunk Console
index=* sourcetype=puppet:summary and if everything was done properly, you should see the reports (and soon facts) from the systems in your Puppet environment.
Want to know more?
There are many additional ways to configure the Splunk Hec module not covered in these instructions, such as only sending Puppet data to Splunk for failed Puppet runs. These topics are covered in the Splunk Hec README. In addition, PE users can install the Puppet Alert Actions app and trigger Bolt tasks and more based on Puppet data in Splunk.