splunk.es.data_input_network module – Manage Splunk Data Inputs of type TCP or UDP
Note
This module is part of the splunk.es collection (version 4.0.0).
You might already have this collection installed if you are using the ansible
package.
It is not included in ansible-core
.
To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install splunk.es
.
To use it in a playbook, specify: splunk.es.data_input_network
.
New in splunk.es 1.0.0
DEPRECATED
- Removed in:
major release after 2024-09-01
- Why:
Newer and updated modules released with more functionality.
- Alternative:
splunk_data_inputs_network
Synopsis
This module allows for addition or deletion of TCP and UDP Data Inputs in Splunk.
Aliases: splunk_data_input_network
Parameters
Parameter |
Comments |
---|---|
Set the host for the remote server that is sending data.
Choices:
|
|
Forwarders can transmit three types of data: raw, unparsed, or parsed. Choices:
|
|
Host from which the indexer gets data. |
|
default Index to store generated events. |
|
The input port which receives raw data. |
|
Choose between tcp or udp Choices:
|
|
Specifies where the input processor should deposit the events it reads. Defaults to parsingQueue. Set queue to parsingQueue to apply props.conf and other parsing rules to your data. For more information about props.conf and rules for timestamping and linebreaking, refer to props.conf and the online documentation at “Monitor files and directories with inputs.conf” Set queue to indexQueue to send your data directly into the index. Choices:
|
|
Specifies in seconds the timeout value for adding a Done-key. If a connection over the port specified by name remains idle after receiving data for specified number of seconds, it adds a Done-key. This implies the last event is completely received. Default: |
|
Allows for restricting this input to only accept data from the host specified here. |
|
Sets the source key/field for events from this input. Defaults to the input file path. Sets the source key initial value. The key is used during parsing/indexing, in particular to set the source field during indexing. It is also the source field used at search time. As a convenience, the chosen string is prepended with ‘source::’. Note: Overriding the source key is generally not recommended. Typically, the input layer provides a more accurate string to aid in problem analysis and investigation, accurately recording the file from which the data was retrieved. Consider use of source types, tagging, and search wildcards before overriding this value. |
|
Set the source type for events from this input. “sourcetype=” is automatically prepended to <string>. Defaults to audittrail (if signedaudit=True) or fschange (if signedaudit=false). |
|
Enable or disble ssl for the data stream Choices:
|
|
Enable, disable, create, or destroy Choices:
|
Examples
- name: Example adding data input network with splunk.es.data_input_network
splunk.es.data_input_network:
name: "8099"
protocol: "tcp"
state: "present"
Status
This module will be removed in a major release after 2024-09-01. [deprecated]
For more information see DEPRECATED.