Module does not work with Splunk 7.1.x or 7.2.x

[rbclark]

In Splunk 7.1 and above, Splunk has removed the splunk service.

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 4.10.12
• Ruby: ruby 2.0.0p648
• Distribution: RHEL 7
• Module version: 4fe1532

How to reproduce (e.g Puppet code you use)

With the Splunk 7.2.3 RPM in a yum repository accessible to your system:

  class { '::splunk':
    pkg_provider => 'yum',
    splunk_user  => 'splunk',
  }

What are you seeing

Splunk fails due to the splunk service no longer existing in Splunk 7.1 and 7.2. It seems that on Linux the new service setup might look a lot more like the windows setup, with there only being 2 services, Splunkd, and splunkweb.

What behaviour did you expect instead

A successful install of Splunk

Output log

Error: Systemd start for splunk failed!
journalctl log for splunk:
-- No entries --

Error: /Stage[main]/Splunk::Virtual/Service[splunk]/ensure: change from stopped to running failed: Systemd start for splunk failed!
journalctl log for splunk:
-- No entries --

Any additional information you'd like to impart

It seems that splunk has also renamed the splunkd service to Splunkd.

[bastelfreak]

Hi @rbclark, thanks for the report. Are you able to provide a PR to add spunk 7.1/7.2 support?

[nick-markowski]

@bastelfreak @rbclark I have some staged updates for 7.X I could clean up and submit. In one of my updates, I accounted for legacy mode - is that an update the community cares for?

[bastelfreak]

Is is actually a default gem? At least on archlinux it isn't bundled with ruby2,6, as far as I know. It's a stand alone gem.

[nick-markowski]

@bastelfreak My apologies, I'm not sure which gem you are referring to. I was questioning the support of running the deprecated splunkweb service, separate from splunkd, documented here: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/StartSplunk#Start_Splunk_Enterprise_on_Unix_in_legacy_mode It's not recommended - I'm not sure if that's something worth maintaining as part of the module.

[bastelfreak]

Oh lol, my comment was for a different issue. Anyways: Yes, a PR with your changes is probably a good idea.

[nick-markowski]

Working on a larger refactor to make this happen