From 9205c3daafb02fc6cc105aa4d8ca21634d0a41df Mon Sep 17 00:00:00 2001 From: Niraj Desai <100308049+niraj-desai-sf@users.noreply.github.com> Date: Tue, 29 Apr 2025 13:59:00 -0700 Subject: [PATCH 1/4] Support SHC --- roles/splunk_search_head/tasks/main.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/roles/splunk_search_head/tasks/main.yml b/roles/splunk_search_head/tasks/main.yml index f74c88dc..7956be25 100644 --- a/roles/splunk_search_head/tasks/main.yml +++ b/roles/splunk_search_head/tasks/main.yml @@ -3,13 +3,18 @@ set_fact: splunk_search_head_captain: false +- name: Extract subdomain from hostname + set_fact: + splunk_hostname_subdomain: "{{ splunk.hostname.split('.')[0] }}" + +- name: Splunk FQDN hostname with mesh endpoint + set_fact: + splunk_hostname_mesh: "{{ splunk.hostname | replace('cluster.local','mesh.sfdc.net') }}" + - name: Determine captaincy set_fact: splunk_search_head_captain: true - when: ansible_hostname == splunk.search_head_captain_url or - ansible_fqdn == splunk.search_head_captain_url or - splunk.hostname == splunk.search_head_captain_url or - splunk.role == "splunk_search_head_captain" + when: splunk_hostname_subdomain in splunk.search_head_captain_url - include_tasks: search_head_clustering.yml when: From b493086a9443190740cc494216dce8ba45626bf9 Mon Sep 17 00:00:00 2001 From: Niraj Desai <100308049+niraj-desai-sf@users.noreply.github.com> Date: Tue, 29 Apr 2025 14:00:55 -0700 Subject: [PATCH 2/4] Update search_head_clustering.yml --- .../tasks/search_head_clustering.yml | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/roles/splunk_search_head/tasks/search_head_clustering.yml b/roles/splunk_search_head/tasks/search_head_clustering.yml index 8d181e0b..c3da0c65 100644 --- a/roles/splunk_search_head/tasks/search_head_clustering.yml +++ b/roles/splunk_search_head/tasks/search_head_clustering.yml @@ -2,9 +2,28 @@ - include_tasks: ../../../roles/splunk_common/tasks/wait_for_splunk_instance.yml vars: splunk_instance_address: "{{ splunk.deployer_url }}" + +- name: Update Server name in server.conf to use FQDN + ini_file: + dest: "{{ splunk.home }}/etc/system/local/server.conf" + section: general + option: "serverName" + value: "{{ splunk_hostname_mesh }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" + +- name: Set register replication address + ini_file: + dest: "{{ splunk.home }}/etc/system/local/server.conf" + section: shclustering + option: "register_replication_address" + value: "{{ splunk_hostname_mesh }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" + #INFRA-38882: Update exec command? - name: Initialize SHC cluster config - command: "{{ splunk.exec }} init shcluster-config -auth '{{ splunk.admin_user }}:{{ splunk.password }}' -mgmt_uri '{{ cert_prefix }}://{{ splunk.hostname }}:{{ splunk.svc_port }}' -replication_port {{ splunk.shc.replication_port }} -replication_factor {{ splunk.shc.replication_factor }} -conf_deploy_fetch_url '{{ cert_prefix }}://{{ splunk.deployer_url }}:{{ splunk.svc_port }}' -secret '{{ splunk.shc.pass4SymmKey }}' -shcluster_label '{{ splunk.shc.label }}'" + command: "{{ splunk.exec }} init shcluster-config -auth '{{ splunk.admin_user }}:{{ splunk.password }}' -mgmt_uri '{{ cert_prefix }}://{{ splunk_hostname_mesh }}:{{ splunk.svc_port }}' -replication_port {{ splunk.shc.replication_port }} -replication_factor {{ splunk.shc.replication_factor }} -conf_deploy_fetch_url '{{ cert_prefix }}://{{ splunk.deployer_url }}:{{ splunk.svc_port }}' -secret '{{ splunk.shc.pass4SymmKey }}' -shcluster_label '{{ splunk.shc.label }}'" become: yes become_user: "{{ splunk.user }}" register: task_result From 8c04f0eccfdbcc3a6309ffddb28d6cf979298a08 Mon Sep 17 00:00:00 2001 From: Niraj Desai <100308049+niraj-desai-sf@users.noreply.github.com> Date: Tue, 29 Apr 2025 14:01:16 -0700 Subject: [PATCH 3/4] Update main.yml --- roles/splunk_search_head/tasks/main.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/roles/splunk_search_head/tasks/main.yml b/roles/splunk_search_head/tasks/main.yml index 7956be25..921e053e 100644 --- a/roles/splunk_search_head/tasks/main.yml +++ b/roles/splunk_search_head/tasks/main.yml @@ -10,11 +10,6 @@ - name: Splunk FQDN hostname with mesh endpoint set_fact: splunk_hostname_mesh: "{{ splunk.hostname | replace('cluster.local','mesh.sfdc.net') }}" - -- name: Determine captaincy - set_fact: - splunk_search_head_captain: true - when: splunk_hostname_subdomain in splunk.search_head_captain_url - include_tasks: search_head_clustering.yml when: From d65837eb6bf8764f59a1d7fa2cebf89f0a561ee4 Mon Sep 17 00:00:00 2001 From: Niraj Desai <100308049+niraj-desai-sf@users.noreply.github.com> Date: Tue, 29 Apr 2025 14:01:35 -0700 Subject: [PATCH 4/4] Update search_head_clustering.yml --- roles/splunk_search_head/tasks/search_head_clustering.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/roles/splunk_search_head/tasks/search_head_clustering.yml b/roles/splunk_search_head/tasks/search_head_clustering.yml index c3da0c65..8df46cd0 100644 --- a/roles/splunk_search_head/tasks/search_head_clustering.yml +++ b/roles/splunk_search_head/tasks/search_head_clustering.yml @@ -3,6 +3,11 @@ vars: splunk_instance_address: "{{ splunk.deployer_url }}" +- name: Determine captaincy + set_fact: + splunk_search_head_captain: true + when: splunk_hostname_subdomain in splunk.search_head_captain_url + - name: Update Server name in server.conf to use FQDN ini_file: dest: "{{ splunk.home }}/etc/system/local/server.conf"