Merge pull request #4167 from edx/aali/OPS-1703_splunk_playbook_edx

splunk changes for edx

playbooks/roles/splunk-server/defaults/main.yml

@@ -9,13 +9,12 @@
 #
 ##
 # Defaults for role splunk-server
-# 
+#
 
 #
 # vars are namespaced with the module name.
 #
-SPLUNK_INDEXES: 
-  - "default"
+SPLUNK_INDEXES: []
 
 SPLUNK_ALERTS: []
   # A list of dicts with the following keys:
@@ -83,6 +82,7 @@ SPLUNK_SMTP_USERNAME: username
 SPLUNK_SMTP_PASSWORD: password
 SPLUNK_FROM_ADDRESS: no-reply@example.com
 SPLUNK_EMAIL_FOOTER: Generated by {{ SPLUNK_HOSTNAME }}
+SPLUNK_SSL_HOSTNAME: splunk.example.com:443
 
 # SSL settings. Either all or none of these must be defined.
 # For more details about setting up splunk with SSL, see
@@ -94,7 +94,7 @@ SPLUNK_SSL_ROOT_CA: !!null
 splunk-server_role_name: splunk-server
 
 splunk_user: "splunk"
-splunk_root: "/vol/splunk/storage"
+splunk_root: "/vol/splunk"
 splunk_home: "/opt/splunk"
 
 splunk_hot_dir: "{{ splunk_root }}/hot"

playbooks/roles/splunk-server/tasks/main.yml

@@ -55,7 +55,7 @@
     dest: "{{ splunk_home }}/etc/system/local/inputs.conf"
     owner: splunk
     group: splunk
-    mode: "0644"
+    mode: "0600"
 
 - name: Create bucket directories
   file:
@@ -90,7 +90,7 @@
     dest: "{{ splunk_home }}/etc/apps/search/local/indexes.conf"
     owner: "{{ splunk_user }}"
     group: "{{ splunk_user }}"
-    mode: 0700
+    mode: 0600
   tags:
     - "install"
     - "install:configuration"
@@ -101,7 +101,7 @@
     dest: "{{ splunk_home }}/etc/system/local/alert_actions.conf"
     owner: "{{ splunk_user }}"
     group: "{{ splunk_user }}"
-    mode: 0700
+    mode: 0600
   tags:
     - install
     - install:configuration
@@ -112,7 +112,7 @@
     dest: "{{ splunk_home }}/etc/apps/search/local/savedsearches.conf"
     owner: "{{ splunk_user }}"
     group: "{{ splunk_user }}"
-    mode: 0700
+    mode: 0600
   tags:
     - "install"
     - "install:configuration"

playbooks/roles/splunk-server/templates/opt/splunk/etc/apps/search/local/indexes.conf.j2

-{% for name in SPLUNK_INDEXES %}
-[{{ name }}]
-coldPath = {{ splunk_cold_dir }}/{{ name }}/colddb
-homePath = {{ splunk_hot_dir }}/{{ name }}/db
-thawedPath = {{ splunk_thawed_dir }}/{{ name }}/thaweddb
-coldToFrozenDir = {{ splunk_frozen_dir }}/{{ name }}/frozendb
+{% for index in SPLUNK_INDEXES %}
+[{{ index.name }}]
+{% if index.coldPath is defined %}
+coldPath = {{ index.coldPath }}
+{% else %}
+coldPath = {{ splunk_cold_dir }}/{{ index.name }}/colddb
+{% endif %}
+{% if index.homePath is defined %}
+homePath = {{ index.homePath }}
+{% else %}
+homePath = {{ splunk_hot_dir }}/{{ index.name }}/db
+{% endif %}
+{% if index.maxTotalDataSizeMB is defined %}
+maxTotalDataSizeMB = {{ index.maxTotalDataSizeMB }}
+{% endif %}
+{% if index.thawedPath is defined %}
+thawedPath = {{ index.thawedPath }}
+{% else %}
+thawedPath = {{ splunk_thawed_dir }}/{{ index.name }}/thaweddb
+{% endif %}
+{% if index.coldToFrozenDir is not defined %}
+coldToFrozenDir = {{ splunk_frozen_dir }}/{{ index.name }}/frozendb
+{% endif %}
+{% if index.disabled is defined %}
+disabled = {{ index.disabled }}
+{% endif %}
+{% if index.home is defined %}
+home = {{ index.home }}
+{% endif %}
+{% if index.enableDataIntegrityControl is defined %}
+enableDataIntegrityControl = {{ index.enableDataIntegrityControl }}
+{% endif %}
+{% if index.enableTsidxReduction is defined %}
+enableTsidxReduction = {{ index.enableTsidxReduction }}
+{% endif %}
 
 {% endfor %}
+

playbooks/roles/splunk-server/templates/opt/splunk/etc/apps/search/local/props.conf.j2

@@ -4,6 +4,43 @@
 {% elif 'sourcetype' in extraction %}
 [{{ extraction.sourcetype }}]
 {% endif %}
+{% if extraction.break_before is defined%}
+BREAK_ONLY_BEFORE = {{ extraction.break_before }}
+{% endif %}
+{% if extraction.max_events is defined%}
+MAX_EVENTS = {{ extraction.max_events }}
+{% endif %}
+{% if extraction.datetime_config is defined %}
+DATETIME_CONFIG = {{ extraction.datetime_config }}
+{% endif %}
+{% if extraction.indexed_extractions is defined %}
+INDEXED_EXTRACTIONS = {{ extraction.indexed_extractions }}
+{% endif %}
+{% if extraction.no_binary_check is defined %}
+NO_BINARY_CHECK = {{ extraction.no_binary_check }}
+{% endif %}
+{% if extraction.timestamp_fields is defined %}
+TIMESTAMP_FIELDS = {{ extraction.timestamp_fields }}
+{% endif %}
+{% if extraction.category is defined %}
+category = {{ extraction.category }}
+{% endif %}
+{% if extraction.description is defined %}
+description = {{ extraction.description }}
+{% endif %}
+{% if extraction.disabled is defined %}
+disabled = {{ extraction.disabled }}
+{% endif %}
+{% if extraction.pulldown_type is defined %}
+pulldown_type = {{ extraction.pulldown_type }}
+{% endif %}
+{% if extraction.name is defined %}
 EXTRACT-{{ extraction.name }} = {{ extraction.regex }}
+{% endif %}
+{% if 'sourcetype' in extraction and extraction.sourcetype == "build_log" %}
+EXTRACT-run-results = Setting status of .* and message: 'Build finished. (?P<num_run>\d+) tests run, (?P<num_skipped>\d+) skipped, (?P<num_failed>\d+) failed.
+EXTRACT-error_msg = \n?ERROR: (?P<error_msg>[^\n]*)
+EXTRACT-buildResult = Finished: (?P<buildResult>[A-Z]+)$
+{% endif %}
 
 {% endfor %}

playbooks/roles/splunk-server/templates/opt/splunk/etc/apps/search/local/savedsearches.conf.j2

@@ -4,49 +4,247 @@
 {% for search in SPLUNK_ALERTS %}
 [{{ search.name }}]
 {% if search.email is defined %}
-{# Default email options:
-   action.email.include.view_link = 1     Include a link to the alert
-   action.email.include.results_link = 1  Include a link to the results #}
-action.email = 1
-{# Include the search string #}
-action.email.include.search = 1
-{# Needed for the next option #}
-action.email.sendresults = 1
-{# Include the search results as a table in the body of the message #}
-action.email.inline = 1
-{# Include the alert trigger #}
-action.email.include.trigger = 1
-{# Include a timestamp of when the alert was triggered #}
-action.email.include.trigger_time = 1
-action.email.to = {{ search.email | join(', ') }}
-{# No idea what this does, it's undocumented #}
-action.email.reportServerEnabled = 0
-{# Use a namespaced subject. No idea what that means. #}
-action.email.useNSSubject = 1
-{% if search.message is defined %}
+action.email = {{ search.email }}
+{% endif %}
+{% if search.email_format is defined %}
+action.email.format = {{ search.email_format }}
+{% endif %}
+{% if search.email_alert is defined %}
 {# Include a backslash before newlines to match splunk's wonky INI format #}
-action.email.message.alert = {{ search.message.split('\n') | join('\\\n')}}
-{% endif %}
-{% endif %}
-alert.severity = {{ search.severity | default(SPLUNK_ALERT_DEFAULT_SEVERITY) }}
-alert.track = 1
-counttype = {{ search.counttype | default("number of events") }}
-quantity = {{ search.quantity | default("0") }}
-relation = {{ search.comparison | default("greater than") }}
-enableSched = 1
-cron_schedule = {{ search.schedule | default("*/15 * * * *") }}
-dispatch.earliest_time = {{ search.time | default("-15m") }}
-dispatch.latest_time = {{ "rt" if search.time == "rt" else "now" }}
-alert.digest_mode = {{ "0" if search.time == "rt" else "1" }}
-{% if search.digest_delay is defined %}
-alert.suppress = 1
-alert.suppress.period = {{ search.digest_delay }}
-{% endif %}
-request.ui_dispatch_app = search
-request.ui_dispatch_view = search
-{% if search.description %}
+action.email.message.alert = {{ search.email_alert.split('\n') | join('\\\n')}}
+{% endif %}
+{% if search.email_inline is defined %}
+action.email.inline = {{ search.email_inline }}
+{% endif %}
+{% if search.email_reportserverenabled is defined %}
+action.email.reportServerEnabled = {{ search.email_reportserverenabled }}
+{% endif %}
+{% if search.email_priority is defined %}
+action.email.priority = {{ search.email_priority }}
+{% endif %}
+{% if search.email_csv is defined %}
+action.email.sendcsv = {{ search.email_csv }}
+{% endif %}
+{% if search.email_to is defined %}
+action.email.to = {{ search.email_to }}
+{% endif %}
+{% if search.email_sendresults is defined %}
+action.email.sendresults = {{ search.email_sendresults }}
+{% endif %}
+{% if search.email_report is defined %}
+action.email.message.report = {{ search.email_report }}
+{% endif %}
+{% if search.email_sendpdf is defined %}
+action.email.sendpdf = {{ search.email_sendpdf }}
+{% endif %}
+{% if search.email_include_search is defined %}
+action.email.include.search = {{ search.email_include_search }}
+{% endif %}
+{% if search.email_bcc is defined %}
+action.email.bcc = {{ search.email_bcc  }}
+{% endif %}
+{% if search.email_cc is defined %}
+action.email.cc = {{ search.email_cc  }}
+{% endif %}
+{% if search.email_content_type is defined %}
+action.email.content_type = {{ search.email_content_type }}
+{% endif %}
+{% if search.email_result_link is defined %}
+action.email.include.results_link = {{ search.email_result_link }}
+{% endif %}
+{% if search.email_view_link is defined %}
+action.email.include.view_link = {{ search.email_view_link }}
+{% endif %}
+{% if search.email_sub is defined %}
+action.email.subject = {{ search.email_sub }}
+{% endif %}
+{% if search.email_sub_alert is defined %}
+action.email.subject.alert = {{ search.email_sub_alert }}
+{% endif %}
+{% if search.email_sub_report is defined %}
+action.email.subject.report = {{ search.email_sub_report }}
+{% endif %}
+{% if search.email_NSSsub is defined %}
+action.email.useNSSubject = {{ search.email_NSSsub }}
+{% endif %}
+{% if search.email_trigger_time is defined %}
+action.email.include.trigger_time = {{ search.email_trigger_time }}
+{% endif %}
+{% if search.email_trigger is defined %}
+action.email.include.trigger = {{ search.email_trigger  }}
+{% endif %}
+{% if search.timespan is defined %}
+auto_summarize.timespan = {{ search.timespan }}
+{% endif %}
+{% if search.display_general_type is defined %}
+display.general.type = {{ search.display_general_type  }}
+{% endif %}
+{% if search.display_search_tab is defined %}
+display.page.search.tab = {{ search.display_search_tab  }}
+{% endif %}
+{% if search.search_pattern_sensitivity is defined %}
+display.page.search.patterns.sensitivity = {{ search.search_pattern_sensitivity }}
+{% endif %}
+{% if search.enablesched is defined %}
+enableSched = {{ search.enablesched }}
+{% endif %}
+{% if search.dispatch_app is defined %}
+request.ui_dispatch_app  = {{ search.dispatch_app }}
+{% endif %}
+{% if search.events_fields is defined %}
+display.events.fields = ["{{ search.events_fields | list | join ("\",\"") }}"]
+{% endif %}
+{% if search.visual_chart_height is defined %}
+display.visualizations.chartHeight = {{ search.visual_chart_height }}
+{% endif %}
+{% if search.visual_chart is defined %}
+display.visualizations.charting.chart  = {{ search.visual_chart }}
+{% endif %}
+{% if search.visual_show is defined %}
+display.visualizations.show = {{ search.visual_show }}
+{% endif %}
+{% if search.visual_chart_y_axis is defined %}
+display.visualizations.charting.axisY.scale = {{ search.visual_chart_y_axis }}
+{% endif %}
+{% if search.visual_beforelabel is defined %}
+display.visualizations.singlevalue.beforeLabel = {{ search.visual_beforelabel }}
+{% endif %}
+{% if search.visual_underlabel is defined %}
+display.visualizations.singlevalue.underLabel = {{ search.visual_underlabel }}
+{% endif %}
+{% if search.display_timerange is defined %}
+display.general.timeRangePicker.show = {{ search.display_timerange }}
+{% endif %}
+{% if search.visual_drilldown is defined %}
+display.visualizations.charting.drilldown = {{ search.visual_drilldown }}
+{% endif %}
+{% if search.display_chart_mode is defined %}
+display.visualizations.charting.chart.stackMode = {{ search.display_chart_mode }}
+{% endif %}
+{% if search.visual_Y_axis_title is defined %}
+display.visualizations.charting.axisTitleY.text = {{ search.visual_Y_axis_title }}
+{% endif %}
+{% if search.visual_X_axis_title is defined %}
+display.visualizations.charting.axisTitleX.text = {{ search.visual_X_axis_title }}
+{% endif %}
+{% if search.visual_chart_legend_place is defined %}
+display.visualizations.charting.legend.placement = {{ search.visual_chart_legend_place }}
+{% endif %}
+{% if search.visual_chart_nullvalue is defined %}
+display.visualizations.charting.chart.nullValueMode = {{ search.visual_chart_nullvalue }}
+{% endif %}
+{% if search.visual_chart_layout is defined %}
+display.visualizations.charting.layout.splitSeries = {{ search.visual_chart_layout }}
+display.visualizations.charting.layout.splitSeries.allowIndependentYRanges = {{ search.visual_chart_layout_splitseries_y_range }}
+{% endif %}
+{% if search.visual_chart_legend_style is defined %}
+display.visualizations.charting.legend.labelStyle.overflowMode = {{ search.visual_chart_legend_style }}
+{% endif %}
+{% if search.visual_chart_style is defined %}
+display.visualizations.charting.chart.style = {{ search.visual_chart_style }}
+{% endif %}
+{% if search.visual_afterlabel is defined %}
+display.visualizations.singlevalue.afterLabel = {{ search.visual_afterlabel }}
+{% endif %}
+{% if search.display_event_list_wrap is defined %}
+display.events.list.wrap = {{ search.display_event_list_wrap }}
+{% endif %}
+{% if search.dispatch_sample_ratio is defined %}
+dispatch.sample_ratio = {{ search.dispatch_sample_ratio }}
+{% endif %}
+{% if search.display_events_maxlines is defined %}
+display.events.maxLines = {{ search.display_events_maxlines }}
+{% endif %}
+{% if search.display_events_rownum is defined %}
+display.events.rowNumbers = {{ search.display_events_rownum }}
+{% endif %}
+{% if search.display_events_drilldown is defined %}
+display.events.table.drilldown = {{ search.display_events_drilldown }}
+{% endif %}
+{% if search.display_events_table_wrap is defined %}
+display.events.table.wrap = {{ search.display_events_table_wrap }}
+{% endif %}
+{% if search.events_type is defined %}
+display.events.type = {{ search.events_type }}
+{% endif %}
+{% if search.stat_wrap is defined %}
+display.statistics.wrap = {{ search.stat_wrap }}
+{% endif %}
+{% if search.schedule_window is defined %}
+schedule_window = {{ search.schedule_window }}
+{% endif %}
+{% if search.search_mode is defined %}
+display.page.search.mode  = {{ search.search_mode }}
+{% endif %}
+{% if search.auto_summarize is defined %}
+auto_summarize = {{ search.auto_summarize }}
+{% endif %}
+{% if search.suppress is defined %}
+alert.suppress = {{ search.suppress }}
+{% endif %}
+{% if search.description is defined %}
 description = {{ search.description }}
 {% endif %}
+{% if search.suppress_period is defined %}
+alert.suppress.period = {{ search.suppress_period }}
+{% endif %}
+{% if search.severity is defined %}
+alert.severity = {{ search.severity }}
+{% endif %}
+{% if search.track is defined %}
+alert.track = {{ search.track }}
+{% endif %}
+{% if search.dispatch_as is defined %}
+dispatchAs = {{ search.dispatch_as }}
+{% endif %}
+{% if search.opsgenie is defined %}
+action.opsgenie = {{ search.opsgenie }}

+action.opsgenie.param.api_url = {{ search.opsgenie_api_url }}
+{% endif %}
+{% if search.digest_mode is defined %}
+alert.digest_mode = {{ search.digest_mode }}
+{% endif %}
+{% if search.stats is defined %}
+display.statistics.show = {{ search.stats }}
+{% endif %}
+{% if search.alert_condition is defined %}
+alert_condition = {{ search.alert_condition }}
+{% endif %}
+{% if search.counttype is defined %}
+counttype = {{ search.counttype }}
+{% endif %}
+{% if search.displayview is defined %}
+displayview = {{ search.displayview }}
+{% endif %}
+{% if search.dispatchview is defined %}
+request.ui_dispatch_view = {{ search.dispatchview }}
+{% endif %}
+{% if search.schedule is defined %}
+cron_schedule = {{ search.schedule }}
+{% endif %}
+{% if search.disabled is defined %}
+disabled = {{ search.disabled }}
+{% endif %}
+{% if search.quantity is defined %}
+quantity = {{ search.quantity }}
+{% endif %}
+{% if search.time is defined %}
+dispatch.earliest_time = {{ search.time }}
+{% endif %}
+{% if search.relation is defined %}
+relation = {{ search.relation }}
+{% endif %}
+{% if search.dispatch_earliest_time is defined %}
+auto_summarize.dispatch.earliest_time = {{ search.dispatch_earliest_time }}
+{% endif %}
+{% if search.dispatch_latest_time is defined %}
+dispatch.latest_time = {{ search.dispatch_latest_time }}
+{% endif %}
+{% if search.search is defined %}
 search = {{ search.search }}
+{% endif %}
+{% if search.vsid is defined %}
+vsid = {{ search.vsid }}
+{% endif %}
 
 {% endfor %}

playbooks/roles/splunk-server/templates/opt/splunk/etc/system/local/alert_actions.conf.j2

 [email]
-mailserver = {{ SPLUNK_SMTP_SERVER }}
-pdf.header_left = none
-pdf.header_right = none
 auth_password = {{ SPLUNK_SMTP_PASSWORD }}
 auth_username = {{ SPLUNK_SMTP_USERNAME }}
 footer.text = {{ SPLUNK_EMAIL_FOOTER }}
-hostname = {{ SPLUNK_HOSTNAME }}
+hostname = {{ SPLUNK_SSL_HOSTNAME }}
+mailserver = {{ SPLUNK_SMTP_SERVER }}
+reportServerURL =
+use_tls = 1
+pdf.header_left = none
+pdf.header_right = none
+use_ssl = 0
 from = {{ SPLUNK_FROM_ADDRESS }}
-pdf.footer_enabled = 0
-pdf.header_enabled = 0
-use_tls = 1
\ No newline at end of file

playbooks/roles/splunk-server/templates/opt/splunk/etc/system/local/inputs.conf.j2

@@ -6,8 +6,8 @@ host = {{ SPLUNK_HOSTNAME }}
 compressed = true
 
 [SSL]
-serverCert = $SPLUNK_HOME/{{ splunk_cert_path }}/forwarder.pem
 password = {{ SPLUNK_SSL_PASSWORD }}
 requireClientCert = false
 rootCA = $SPLUNK_HOME/{{ splunk_cert_path }}/cacert.pem
-{% endif %}
+serverCert = $SPLUNK_HOME/{{ splunk_cert_path }}/forwarder.pem
\ No newline at end of file
+{% endif %}