Prepare template files for splunk.

playbooks/roles/splunk/defaults/main.yml

@@ -14,7 +14,7 @@
 #
 # vars are namespace with the module name.
 #
-splunk_role_name: splunk
+splunk_role_name: 'splunk'
 
 #
 # OS packages
@@ -22,4 +22,13 @@ splunk_role_name: splunk
 
 splunk_debian_pkgs: []
 
-splunk_redhat_pkgs: []
+splunk_redhat_pkgs: []
\ No newline at end of file
+
+LOG_ITEMS:
+  - directory: '/var/log'
+    recursive: true
+
+SPLUNK_SERVER: 'localhost:9997'
+
+log_items: $LOG_ITEMS
+splunk_server: $SPLUNK_SERVER

playbooks/roles/splunk/templates/splunk.inputs.conf.j2

+[default]
+host = {{ansible_hostname}}
+
+{% for loggable in log_items%}
+[monitor://{{loggable.directory}}]
+recursive = {{loggable.recursive|default(false)}}
+{% if loggable.sourcetype is defined %}
+sourcetype = loggable.sourcetype
+{% endif %}
+{% if loggable.index is defined %}
+index = loggable.index
+{% endif %}
+{% endfor %}

playbooks/roles/splunk/templates/splunk.outputs.conf.j2

+[tcpout]
+defaultGroup = default_output_server
+
+[tcpout:default_output_server]
+server = {{splunk_server}}
+
+[tcpout-server://{{splunk_server}}]
+