Skip to main content
Splunk Enterprise, deployed the same way every time. Indexers, search heads, license, done.
Language: Python  ·  Status: active  ·  Last active: this week  ·  Source on GitHub
ansible-splunk is the configuration tier for Splunk Enterprise. It deploys and configures a Splunk install onto hosts that tofu-splunk-aws provisioned (or onto homelab hardware that ansible-proxmox configured), then maintains the install through ongoing playbook runs.

​
What it does

  • Installs Splunk Enterprise and applies a license
  • Configures per-index HEC inputs: one token per index, matching Cribl Stream’s per-index outputs
  • Configures indexes (unifi, firewall, os, honeypot, dns, proxy, the AI-log indexes, and more) and storage tiering (hot/warm/cold)
  • Deploys per-index silence detectors: an alert per index that fires when the index stops receiving events within its expected cadence
  • Pins and installs Splunk apps and TAs; see observability content ownership
  • Runs idempotently: safe to re-run as a drift-correction tool

​
HEC inputs

Each HEC token scopes to a single index. The family → port → index map lives on the observability overview.

​
How it fits

The Ansible configuration tier for Splunk. It configures the install and pins apps owned by their repositories.

​
Getting started

1

Confirm hosts are ready

Run tofu-splunk-aws (cloud) or ansible-proxmox (homelab) first. Hosts need OS, storage, and network in place.
2

Clone and enter the dev shell

git clone https://github.com/dryvist/ansible-splunk && cd ansible-splunk && nix develop
3

Required environment

The playbook reads the Splunk license file and any pre-shared HEC tokens as environment variables.
4

Run the playbook

ansible-playbook -i inventory site.yml. The first run installs Splunk; subsequent runs converge config drift.

tofu-splunk-aws

The AWS provisioner for Splunk hosts.

Observability overview

Where this fits in the OTEL → Cribl → Splunk pipeline.

Data pipelines

The traffic this Splunk install actually receives.

Source on GitHub

Roles, inventory examples, full README.