Enhancement: Join search heads to an indexer cluster about ansible-role-for-splunk

[derek126]

For those interested I added the following to the bottom of configure_shc_members.yml

- name: Integrate sh to indexer cluster
  command: "{{ splunk_home }}/bin/splunk edit cluster-config -mode searchhead -master_uri {{ splunk_uri_cm }} -secret {{ splunk_shc_key }} -auth {{ splunk_auth }}"
  become: true
  become_user: "{{ splunk_nix_user }}"
  register: shc_edit_result
  changed_when: shc_edit_result.rc == 0
  failed_when: shc_edit_result.rc != 0
  notify: restart splunk
  no_log: false 
  until: shc_edit_result.rc == 0
  retries: 6
  delay: 5

Works for me until an official solution or something.

[peterchenadded]

Above is not idempotent, you just need to create an ini_file task that loops through the 3 properties and store in system/local/server.conf and notify : restart Splunk.

[derek126]

We are using the role through Ansible galaxy pointing at this Git repo. Ideally it would be added to the role.

[mason-splunk]

Presumably this would only be run once, when connecting the SH to the indexer cluster, so I'm not sure that idempotency is a concern. Using ini_file to loop through server.conf is also not idempotent because after the restart, splunk will replace the plaintext value of pass4SymmKey with a hash in server.conf. In the event that you are deploying a pre-hashed pass4SymmKey, then I would ask why you wouldn't just put the clustering config into a server.conf file and deploy it to the SH as app via configure_apps.yml.

[mason-splunk]

configure_idxc_sh.yml has been added to the v1.6.1 release to support this functionality.

[peterchenadded]

Hi @mason-splunk , it is idempotent if you have a task that can generically decrypt the encrypted value and compare it to the required value. If the values are different then it should update otherwise skip.

I've actually implemented this, with the Splunk show-decrypted command.

You can then use this anywhere where Splunk encrypts the passwords.

[derek126]

There is a a bug in configure_idxc_sh.yml. It should be

---
- name: Configure search head to join indexer cluster
  command: "{{ splunk_home }}/bin/splunk edit cluster-config -mode searchhead -master_uri {{ splunk_uri_cm }} -secret {{ splunk_idxc_key }} -auth {{ splunk_auth }}"
  become: true
  become_user: "{{ splunk_nix_user }}"
  register: idxc_sh_join_result
  changed_when: idxc_sh_join_result.rc == 0
  failed_when: idxc_sh_join_result.rc != 0
  notify: restart splunk
  no_log: false
  until: idxc_sh_join_result.rc == 0
  retries: 6
  delay: 5

Notice the .rc

[mason-splunk]

@derek126 Good catch. Fixed in v1.6.2 release.