cdillc.splunk.splunk_facts module – Gathers facts about a Splunk installation

Note

This module is part of the cdillc.splunk collection (version 0.26.1).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install cdillc.splunk.

To use it in a playbook, specify: cdillc.splunk.splunk_facts.

New in cdillc.splunk 0.10.0

Synopsis

• This module collects various pieces of data about a Splunk installation.

• Splunk apps data collection.

Parameters

Parameter	Comments
app_dirs list / elements=string	List of paths (relative to $SPLUNK_HOME/etc). And absolute path can be provided to check a specific path. Default: ["apps", "deployment-apps", "shcluster/apps", "manager-apps", "peer-apps", "master-apps", "slave-apps"]
ksconf string	Set the level of ksconf detail to collect. Use skip to disable all ksconf related facts, short to collect basic information, and detail to show information about the available subcommands. Choices: "skip" "short" ← (default) "detail"
splunk_home path	Path to Splunk installation path. If not provided, this module will check the $SPLUNK_HOME environment variable and then several commonly used install paths.

Attributes

Attribute	Support	Description
facts	Support: full	Action returns an ansible_facts dictionary that will update existing host facts

Notes

Note

• Parameters to enable/disable various config or run-time stats may be added later.

Examples

Typical use:
- splunk_facts:

Or specify a custom Splunk install home
- splunk_facts: splunk_home=/opt/acmeco/splunk

Splunk facts for app hosted in a git repository:
- splunk_facts: app_dirs=/opt/git-repo/apps

Returned Facts

Facts returned by this module are added/updated in the hostvars host facts and can be referenced by name just like any other host fact. They do not need to be registered in order to use them.

Key	Description
ansible_splunk_app_root_missing list / elements=string	App paths that were inaccessible and therefore are not listed in ansible_splunk_apps. Returned: success
ansible_splunk_apps list / elements=dictionary	A list of Splunk apps found. Collection is restricted to the given set of apps in one of the provided app_dirs. Returned: success
app_conf dictionary	Configuration information extracted from app.conf. Only attributes present will be returned, unless otherwise noted. Data types noted below are based on normal app conventions. However, if the app provides unexpected values (like a non-integer build), that value is passed along as-is and therefore may be of another type. Returned: always
author string	Returned: always
build integer	Returned: success
check_for_updates boolean	Returned: success
description string	Longer description contained with the app. (This is not typically shown anywhere in the UI) Returned: success
is_visible boolean	Is the app visible in the user interface Returned: success
label string	Display name Returned: success
state string	Returned: success
version string	Returned: always
name string	Folder name of the Splunk app Returned: always
path string	Full path to Splunk application. This will uniquely identify an app. Returned: always
root string	app location prefix (based on the given value of app_dirs) Returned: always Sample: "deployment-apps"
sideload dictionary	Data loaded is dependent upon the version of ksconf and the sideload module. Returned: Only present if the app was installed via ksconf_sideload_app module.
ansible_module_version string	Returned: success
installed_at string	Returned: success
src_hash string	Returned: success
src_path string	Returned: success
ansible_splunk_config dictionary	splunk configs Returned: success Sample: {"<config>": {"<stanza>": {"<key>": "value"}}}
ansible_splunk_dist_search string	distributed search public key Returned: success
ansible_splunk_ksconf dictionary	ksconf version information Returned: when requested
build integer	Returned: success
commands dictionary	Returned: success
<command> dictionary	The key <command> is dynamically set for each sub-command of the ksconf tool. Returned: success Sample: "xml-format"
class string	class name Returned: success
distro string	Returned: success
error string	Any errors related to specific ksconf commands. This can happen for example if some Python modules are missing such as lxml or splunksdk. Returned: on error
package string	Returned: success
path string	Returned: success
vcs_info string	Returned: success
version string	Returned: success
ansible_splunk_launch dictionary	Splunk’s startup configuration files located in splunk-launch.conf. The exact keys located here will vary based on which settings are present. Contents shown here are based on popular settings. Returned: success
PYTHONHTTPSVERIFY string	Returned: success
SPLUNK_DB string	Default path to splunk indexes. Returned: success
SPLUNK_OS_USER string	Name of the user Splunk runs as. Returned: success
SPLUNK_SERVER_NAME string	Local server’s name. Popular values include Splunkd and SplunkForwarder Returned: success
ansible_splunk_swid dictionary	Software id tags Returned: success
name string	Software name. Examples include Splunk Enterprise and UniversalForwarder. Returned: success Sample: "UniversalForwarder"
patch string	Returned: success
version string	Returned: success
ansible_splunk_version dictionary	Version of the Splunk software found Returned: always
build integer	Returned: success
platform string	Returned: success
product string	Returned: success
version string	Returned: success Sample: "9.0.4"
server_public_key string	public key for splunkd Returned: success

Authors

• Lowell C. Alleman (@lowell80)

Collection links

• Issue Tracker
• Homepage
• Repository (Sources)