diff --git a/templates/splunk-enterprise.template b/templates/splunk-enterprise.template index ec36394..723bab9 100644 --- a/templates/splunk-enterprise.template +++ b/templates/splunk-enterprise.template @@ -741,18 +741,22 @@ "export SPLUNK_USER=splunk\n", "export SPLUNK_BIN=/opt/splunk/bin/splunk\n", "export SPLUNK_HOME=/opt/splunk\n", - "printf '%s\t%s\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n", + "printf '%s\t%s\\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n", "hostname splunksearch\n", "# Stop Splunk and reset password\n", "service splunk stop\n", + "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n", "touch $SPLUNK_HOME/etc/.ui_login\n", "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n", - "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n", + "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n", + "# Force the Splunk startup script to run.\n", + "service splunk start\n", + "service splunk stop\n", "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ", { "Ref": "SplunkAdminPassword" }, - " -role admin -auth admin:changeme\n", + " -role admin -auth admin:$INSTANCEID\n", "# Increase splunkweb connection timeout with splunkd\n", "mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local\n", "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <> /etc/hosts\n", + "printf '%s\t%s\\n' \"$LOCALIP\" 'splunklicense' >> /etc/hosts\n", "hostname splunklicense\n", "# Stop Splunk and reset password\n", "service splunk stop\n", + "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n", "touch $SPLUNK_HOME/etc/.ui_login\n", "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n", - "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n", + "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n", + "# Force the Splunk startup script to run.\n", + "service splunk start\n", + "service splunk stop\n", "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ", { "Ref": "SplunkAdminPassword" }, - " -role admin -auth admin:changeme\n", + " -role admin -auth admin:$INSTANCEID\n", "# Install files from the metadata\n", "/opt/aws/bin/cfn-init -v ", " --stack ", @@ -1077,7 +1085,6 @@ "indexAndForward = false\n", "\n", "[tcpout:indexer_cluster_peers]\n", - "autoLB = true\n", "indexerDiscovery = cluster_master\n", "\n", "[indexer_discovery:cluster_master]\n", @@ -1181,6 +1188,7 @@ ] }, "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/master-apps\n", + "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername splunklicence\n", "service splunk restart\n", "/opt/aws/bin/cfn-signal -e $? --stack ", { @@ -1309,18 +1317,22 @@ "export SPLUNK_USER=splunk\n", "export SPLUNK_BIN=/opt/splunk/bin/splunk\n", "export SPLUNK_HOME=/opt/splunk\n", - "printf '%s\t%s\n' \"$LOCALIP\" 'splunk-shc-deployer' >> /etc/hosts\n", + "printf '%s\t%s\\n' \"$LOCALIP\" 'splunk-shc-deployer' >> /etc/hosts\n", "hostname splunk-shc-deployer\n", "# Stop Splunk and reset password\n", "service splunk stop\n", + "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n", "touch $SPLUNK_HOME/etc/.ui_login\n", "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n", - "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n", + "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n", + "# Force the Splunk startup script to run.\n", + "service splunk start\n", + "service splunk stop\n", "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ", { "Ref": "SplunkAdminPassword" }, - " -role admin -auth admin:changeme\n", + " -role admin -auth admin:$INSTANCEID\n", "# Increase splunkweb connection timeout with splunkd\n", "mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local\n", "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <> /etc/hosts\n", + "printf '%s\t%s\\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n", "hostname splunksearch\n", "# Stop Splunk and reset password\n", "service splunk stop\n", + "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n", "touch $SPLUNK_HOME/etc/.ui_login\n", "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n", - "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n", + "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n", + "# Force the Splunk startup script to run.\n", + "service splunk start\n", + "service splunk stop\n", "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ", { "Ref": "SplunkAdminPassword" }, - " -role admin -auth admin:changeme\n", + " -role admin -auth admin:$INSTANCEID\n", "# Increase splunkweb connection timeout with splunkd\n", "cat >$SPLUNK_HOME/etc/system/local/web.conf <> /etc/hosts\n", + "printf '%s\t%s\\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n", "hostname splunksearch\n", "# Stop Splunk and reset password\n", "service splunk stop\n", + "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n", "touch $SPLUNK_HOME/etc/.ui_login\n", "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n", - "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n", + "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n", + "# Force the Splunk startup script to run.\n", + "service splunk start\n", + "service splunk stop\n", "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ", { "Ref": "SplunkAdminPassword" }, - " -role admin -auth admin:changeme\n", + " -role admin -auth admin:$INSTANCEID\n", "# Increase splunkweb connection timeout with splunkd\n", "cat >$SPLUNK_HOME/etc/system/local/web.conf <> /etc/hosts\n", + "printf '%s\t%s\\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n", "hostname splunksearch\n", "# Stop Splunk and reset password\n", "service splunk stop\n", + "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n", "touch $SPLUNK_HOME/etc/.ui_login\n", "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n", - "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n", + "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n", + "# Force the Splunk startup script to run.\n", + "service splunk start\n", + "service splunk stop\n", "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ", { "Ref": "SplunkAdminPassword" }, - " -role admin -auth admin:changeme\n", + " -role admin -auth admin:$INSTANCEID\n", "# Increase splunkweb connection timeout with splunkd\n", "cat >$SPLUNK_HOME/etc/system/local/web.conf <>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <