Skip to main content
Splunk Enterprise, deployed the same way every time. Indexers, search heads, license, done.
ansible-splunk is the configuration tier for Splunk Enterprise. It deploys and configures a Splunk install onto hosts that tofu-splunk-aws provisioned (or onto homelab hardware that ansible-proxmox configured), then maintains the install through ongoing playbook runs.

​
What it does

  • Installs Splunk Enterprise and applies a license
  • Configures per-index HEC inputs: one token per index, matching Cribl Stream’s per-index outputs
  • Configures indexes (unifi, firewall, os, honeypot, dns, proxy, the AI-log indexes, and more) and storage tiering (hot/warm/cold)
  • Deploys per-index silence detectors: an alert per index that fires when the index stops receiving events within its expected cadence
  • Wires in conf bundles from the AI-observability Splunk apps and TAs
  • Runs idempotently: safe to re-run as a drift-correction tool

​
HEC tokens are derived, not distributed

Each index’s HEC token is a UUIDv5 of splunk-hec-<index> in a shared private namespace. Cribl Stream (the only Splunk egress) and this repo’s HEC input config derive the same token independently from that formula. No token list ever needs syncing between repos. The namespace UUID is the only secret. Doppler injects it at run time, it is never committed, and a leaked token scopes to a single index. The family → port → index map lives on the observability overview.

​
How it fits

​
Getting started

1

Confirm hosts are ready

Run tofu-splunk-aws (cloud) or ansible-proxmox (homelab) first. Hosts need OS, storage, and network in place.
2

Clone and enter the dev shell

git clone https://github.com/dryvist/ansible-splunk && cd ansible-splunk && nix develop
3

Provide Splunk license and HEC tokens via Doppler

DOPPLER_TOKEN resolves the Splunk license file and any pre-shared HEC tokens at run time. No secrets in git.
4

Run the playbook

ansible-playbook -i inventory site.yml. The first run installs Splunk; subsequent runs converge config drift.

tofu-splunk-aws

The AWS provisioner for Splunk hosts.

Observability overview

Where this fits in the OTEL → Cribl → Splunk pipeline.

Data pipelines

The traffic this Splunk install actually receives.

Source on GitHub

Roles, inventory examples, full README.