Splunk Enterprise

This repository provides Ansible scripts to set up a Distributed Splunk Enterprise environment on Windows Server using WinRM.

Requirements

Make sure to have WinRM enabled.

1. Ansible controller
2. Several Windows Server VMs
3. SMTP server (for sending notifications)

Role Variables

• splunk_download_url: This is the link to download Splunk.

  • Example: https://download.splunk.com/products/splunk/releases/9.1.1/windows/splunk-9.1.1-64e843ea36b1-x64-release.msi

• splunk_home_dir: Where Splunk will be installed.

  • Example: 'C:\Program Files\Splunk'

• splunk_admin_user: Admin username for Splunk.

• splunk_admin_pass: Admin password for Splunk.

Dependencies

You need the Ansible.Windows collection.

Example Playbook

Here’s how to use this role in a playbook:

- hosts: splunk
  roles:
    - role: deekayen.splunk_enterprise
      vars:
        splunk_admin_user: admin
        splunk_admin_pass: encryptme_with_ansible-vault

Author Information

This project is based on the original work by Po-temkin. It was adapted into a generic role by David Norman, known as deekayen.