community.general.splunk callback – Sends task result events to Splunk HTTP Event Collector

Note

This callback plugin is part of the community.general collection (version 6.6.2).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.general. You need further requirements to be able to use this callback plugin, see Requirements for details.

To use it in a playbook, specify: community.general.splunk.

Synopsis

  • This callback plugin will send task results as JSON formatted events to a Splunk HTTP collector.

  • The companion Splunk Monitoring & Diagnostics App is available here https://splunkbase.splunk.com/app/4023/.

  • Credit to “Ryan Currah (@ryancurrah)” for original source upon which this is based.

Requirements

The below requirements are needed on the local controller node that executes this callback.

  • Whitelisting this callback plugin

  • Create a HTTP Event Collector in Splunk

  • Define the URL and token in ansible.cfg

Parameters

Parameter

Comments

authtoken

string

Token to authenticate the connection to the Splunk HTTP collector.

Configuration:

  • INI entry:

    [callback_splunk]
authtoken = VALUE

  • Environment variable: SPLUNK_AUTHTOKEN

batch

string

added in community.general 3.3.0

Correlation ID which can be set across multiple playbook executions.

Configuration:

  • INI entry:

    [callback_splunk]
batch = VALUE

  • Environment variable: SPLUNK_BATCH

include_milliseconds

boolean

added in community.general 2.0.0

Whether to include milliseconds as part of the generated timestamp field in the event sent to the Splunk HTTP collector.

Choices:

  • false ← (default)

  • true

Configuration:

  • INI entry:

    [callback_splunk]
include_milliseconds = false

  • Environment variable: SPLUNK_INCLUDE_MILLISECONDS

url

string

URL to the Splunk HTTP collector source.

Configuration:

  • INI entry:

    [callback_splunk]
url = VALUE

  • Environment variable: SPLUNK_URL

validate_certs

boolean

added in community.general 1.0.0

Whether to validate certificates for connections to HEC. It is not recommended to set to false except when you are sure that nobody can intercept the connection between this plugin and HEC, as setting it to false allows man-in-the-middle attacks!

Choices:

  • false

  • true ← (default)

Configuration:

  • INI entry:

    [callback_splunk]
validate_certs = true

  • Environment variable: SPLUNK_VALIDATE_CERTS

Examples

examples: >
  To enable, add this to your ansible.cfg file in the defaults block
    [defaults]
    callback_whitelist = community.general.splunk
  Set the environment variable
    export SPLUNK_URL=http://mysplunkinstance.datapaas.io:8088/services/collector/event
    export SPLUNK_AUTHTOKEN=f23blad6-5965-4537-bf69-5b5a545blabla88
  Set the ansible.cfg variable in the callback_splunk block
    [callback_splunk]
    url = http://mysplunkinstance.datapaas.io:8088/services/collector/event
    authtoken = f23blad6-5965-4537-bf69-5b5a545blabla88

Authors

  • Stuart Hirst

Hint

Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.