{"id":28400332,"url":"https://github.com/plus3it/splunkforwarder-formula","last_synced_at":"2025-10-25T08:03:37.241Z","repository":{"id":70263195,"uuid":"64683391","full_name":"plus3it/splunkforwarder-formula","owner":"plus3it","description":"Salt formula to install and configure the Splunk Universal Forwarder","archived":false,"fork":false,"pushed_at":"2025-06-01T02:04:21.000Z","size":87,"stargazers_count":0,"open_issues_count":0,"forks_count":6,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-06-01T17:23:08.023Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"SaltStack","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/plus3it.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2016-08-01T16:29:40.000Z","updated_at":"2025-06-01T02:04:23.000Z","dependencies_parsed_at":"2023-11-13T04:26:13.157Z","dependency_job_id":"36e99beb-89aa-41ad-8e0c-446047311348","html_url":"https://github.com/plus3it/splunkforwarder-formula","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/plus3it/splunkforwarder-formula","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fsplunkforwarder-formula","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fsplunkforwarder-formula/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fsplunkforwarder-formula/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fsplunkforwarder-formula/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/plus3it","download_url":"https://codeload.github.com/plus3it/splunkforwarder-formula/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fsplunkforwarder-formula/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262406162,"owners_count":23306092,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-01T10:02:52.858Z","updated_at":"2025-10-25T08:03:37.235Z","avatar_url":"https://github.com/plus3it.png","language":"SaltStack","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![license](https://img.shields.io/github/license/plus3it/splunkforwarder-formula.svg)](./LICENSE)\n[![Travis-CI Build Status](https://travis-ci.org/plus3it/splunkforwarder-formula.svg)](https://travis-ci.org/plus3it/splunkforwarder-formula)\n[![AppVeyor Build Status](https://ci.appveyor.com/api/projects/status/github/plus3it/splunkforwarder-formula?branch=master\u0026svg=true)](https://ci.appveyor.com/project/plus3it/splunkforwarder-formula)\n\n# splunkforwarder-formula\n\nSalt formula to install and configure the Splunk Universal Forwarder. This\nformula supports both Windows and Linux.\n\nOn Windows, the formula depends on the Salt Windows Package Manager (`winrepo`),\nand a `winrepo` package definition must be present for the Splunkforwarder.\nConfiguring `winrepo` is not handled by this formula.\n\n## Available States\n\n-   [splunkforwarder](#splunkforwarder)\n\n### splunkforwarder\n\nInstall and configure the Splunk Universal Forwarder.\n\n## Windows Configuration\n\nThis formula requires configuration via pillar. If the required parameters are\nnot configured in pillar, the formula will fail.\n\n### (Windows) splunkforwarder:lookup:deploymentclient\n\nThis parameter is a map containing the `client_name` and `target_uri` keys.\n`client_name` is a string that identifies the client environment to Splunk.\n`target_uri` is the fqdn:port of the Splunk collector.\n\n\u003e**Required**: `True`\n\n**Example**:\n\n```yaml\nsplunkforwarder:\n  lookup:\n    deploymentclient:\n      client_name: splunk-uf-windows-srv\n      target_uri: 'hostname.domainname:9098'\n```\n\n### (Windows) splunkforwarder:lookup:log_local\n\nThis parameter is a map with a `contents` key that contains the contents of the\n`log-local.cfg` file. The `log-local.cfg` contains information on what logs\nwill be forwarded to the Splunk collector.\n\n\u003e**Required**: `False`\n\u003e\n\u003e**Default**: _See example below_\n\n**Example**:\n\n```yaml\nlog_local:\n  contents: |\n      category.StatusMgr=WARN\n      category.TcpOutputProc=WARN\n      category.FilesystemChangeWatcher=ERROR\n```\n\n### (Windows) splunkforwarder:lookup:inputs\n\nThis parameter is a map with a `sections` key that contains sections of the\nINI-formatted `inputs.conf` file. For syntax and INI sections options, see\n\u003chttp://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf\u003e.\n\n\u003e**Required**: `False`\n\n**Example**:\n\n```yaml\ninputs:\n  sections:\n    'monitor://C:\\path\\to\\app.log': {}\n```\n\n\n### (Windows) splunkforwarder:lookup:package\n\nThe `package` parameter is the name of the package as defined in the winrepo\npackage definition.\n\n\u003e**Required**: `False`\n\u003e\n\u003e**Default**: `splunkforwarder`\n\n**Example**:\n\n```yaml\nsplunkforwarder:\n  lookup:\n    package: splunkforwarder\n```\n\n### (Windows) splunkforwarder:lookup:service\n\nThe `service` parameter is the name of the Windows service for the Splunk\nUniversal Forwarder.\n\n\u003e**Required**: `False`\n\u003e\n\u003e**Default**: `SplunkForwarder`\n\n**Example**:\n\n```yaml\nsplunkforwarder:\n  lookup:\n    service: SplunkForwarder\n```\n\n## Linux Configuration\n\nThis formula requires configuration via pillar. If the required parameters are\nnot configured in pillar, the formula will fail.\n\n### (Linux) splunkforwarder:lookup:package_url\n\nThis parameter is the URL to the RPM package for the Splunk Universal\nForwarder. The formula will use this RPM to install the splunkforwarder.\n\n\u003e**Required**: `True`\n\n**Example**:\n\n```yaml\nsplunkforwarder:\n  lookup:\n    package_url: https://path/to/my/splunkforwarder.rpm\n```\n\n### (Linux) splunkforwarder:lookup:deploymentclient\n\nThis parameter is a map containing the `client_name` and `target_uri` keys.\n`client_name` is a string that identifies the client environment to Splunk.\n`target_uri` is the fqdn:port of the Splunk collector.\n\n\u003e**Required**: `True`\n\n**Example**:\n\n```yaml\nsplunkforwarder:\n  lookup:\n    deploymentclient:\n      client_name: splunk-uf-windows-srv\n      target_uri: 'hostname.domainname:9098'\n```\n\n### (Linux) splunkforwarder:lookup:service_opts\n\nThis parameter is a string representing the options given when starting\nthe Splunk service.\n\n\u003e**Required**: `False`\n\u003e\n\u003e**Default**: `--accept-license`\n\n**Example**:\n\n```yaml\nservice_opts: --accept-license\n```\n\n### (Linux) splunkforwarder:lookup:log_local\n\nThis parameter is a map with a `contents` key that contains the contents of the\n`log-local.cfg` file. The `log-local.cfg` contains information on what logs\nwill be forwarded to the Splunk collector.\n\n\u003e**Required**: `False`\n\u003e\n\u003e**Default**: _See example below_\n\n**Example**:\n\n```yaml\nlog_local:\n  contents: |\n      category.StatusMgr=WARN\n      category.TcpOutputProc=WARN\n      category.FilesystemChangeWatcher=ERROR\n```\n\n### (Linux) splunkforwarder:lookup:inputs\n\nThis parameter is a map with a `sections` key that contains sections of the\nINI-formatted `inputs.conf` file. For syntax and INI sections options, see\n\u003chttp://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf\u003e.\n\n\u003e**Required**: `False`\n\n**Example**:\n\n```yaml\ninputs:\n  sections:\n    'monitor:///path/to/app.log': {}\n```\n\n### (Linux) splunkforwarder:lookup:package\n\nThe `package` parameter is the name of the package as defined in the RPM\nprovided to the `package_url` parameter.\n\n\u003e**Required**: `False`\n\u003e\n\u003e**Default**: `splunkforwarder`\n\n**Example**:\n\n```yaml\nsplunkforwarder:\n  lookup:\n    package: 'splunkforwarder'\n```\n\n### (Linux) splunkforwarder:lookup:service\n\nThe `service` parameter is the name of the Linux service for the Splunk\nUniversal Forwarder.\n\n\u003e**Required**: `False`\n\u003e\n\u003e**Default**: `splunk`\n\n**Example**:\n\n```yaml\nsplunkforwarder:\n  lookup:\n    service: splunk\n```\n\n### (Linux) splunkforwarder:lookup:user\n\nThe `user` is an object of attributes that configure the user for the Splunk\nUniversal Forwarder.\n\n\u003e**Required**: `False`\n\u003e\n\u003e**Default**:\n\u003e\n\u003e```yaml\n\u003euser:\n\u003e  name: splunk\n\u003e  fullname: Splunk Server\n\u003e  home: /opt/splunkforwarder\n\u003e  shell: /bin/bash\n\u003e```\n\n**Example**:\n\n```yaml\nsplunkforwarder:\n  lookup:\n    user:\n      name: splunk\n      fullname: Splunk Server\n      home: /opt/splunkforwarder\n      shell: /bin/bash\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fsplunkforwarder-formula","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplus3it%2Fsplunkforwarder-formula","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fsplunkforwarder-formula/lists"}