splunk.es.splunk_data_inputs_network module – Manage Splunk Data Inputs of type TCP or UDP resource module
Note
This module is part of the splunk.es collection (version 3.0.0).
You might already have this collection installed if you are using the ansible
package. It is not included in ansible-core
. To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install splunk.es
.
To use it in a playbook, specify: splunk.es.splunk_data_inputs_network
.
New in splunk.es 2.1.0
Synopsis
- Module that allows to add/update or delete of TCP and UDP Data Inputs in Splunk.
Note
This module has a corresponding action plugin.
Aliases: data_inputs_network
Parameters
Parameter | Comments |
---|---|
config list / elements=dictionary | Manage and preview protocol input data. |
cipher_suite string |
Specifies list of acceptable ciphers to use in ssl. Only obtained for TCP SSL configuration present on device. |
connection_host string |
Set the host for the remote server that is sending data.
Choices:
|
datatype string |
Choices:
|
disabled boolean |
Indicates whether the input is disabled. Choices:
|
host string |
Host from which the indexer gets data. |
index string |
default Index to store generated events. |
name string / required |
The input port which receives raw data. |
no_appending_timestamp boolean |
If set to true, prevents Splunk software from prepending a timestamp and hostname to incoming events. Only for UDP data input configuration. Choices:
|
no_priority_stripping boolean |
If set to true, Splunk software does not remove the priority field from incoming syslog events. Only for UDP data input configuration. Choices:
|
password string |
Server certificate password, if any. Only for TCP SSL configuration. |
protocol string / required |
Choose whether to manage TCP or UDP inputs Choices:
|
queue string |
Specifies where the input processor should deposit the events it reads. Defaults to parsingQueue. Set queue to parsingQueue to apply props.conf and other parsing rules to your data. For more information about props.conf and rules for timestamping and linebreaking, refer to props.conf and the online documentation at “Monitor files and directories with inputs.conf” Set queue to indexQueue to send your data directly into the index. Only applicable for “/tcp/raw” and “/udp” APIs Choices:
|
raw_tcp_done_timeout integer |
Specifies in seconds the timeout value for adding a Done-key. If a connection over the port specified by name remains idle after receiving data for specified number of seconds, it adds a Done-key. This implies the last event is completely received. Only for TCP raw input configuration. |
require_client_cert string |
Determines whether a client must authenticate. Only for TCP SSL configuration. |
restrict_to_host string |
Allows for restricting this input to only accept data from the host specified here. |
root_ca string |
Certificate authority list (root file). Only for TCP SSL configuration. |
server_cert string |
Full path to the server certificate. Only for TCP SSL configuration. |
source string |
Sets the source key/field for events from this input. Defaults to the input file path. Sets the source key initial value. The key is used during parsing/indexing, in particular to set the source field during indexing. It is also the source field used at search time. As a convenience, the chosen string is prepended with ‘source::’. Note that Overriding the source key is generally not recommended. Typically, the input layer provides a more accurate string to aid in problem analysis and investigation, accurately recording the file from which the data was retrieved. Consider use of source types, tagging, and search wildcards before overriding this value. |
sourcetype string |
Set the source type for events from this input. “sourcetype=” is automatically prepended to <string>. Defaults to audittrail (if signedaudit=true) or fschange (if signedaudit=false). |
ssl boolean |
Enable or disble ssl for the data stream Choices:
|
token string |
Token value to use for SplunkTcpToken. If unspecified, a token is generated automatically. |
running_config string | The module, by default, will connect to the remote device and retrieve the current running-config to use as a base for comparing against the contents of source. There are times when it is not desirable to have the task get the current running-config for every task in a playbook. The running_config argument allows the implementer to pass in the configuration to use as the base config for comparison. This value of this option should be the output received from device by executing command. |
state string | The state the configuration should be left in Choices:
|
Examples
# Using gathered # -------------- - name: Gathering information about TCP Cooked Inputs splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: cooked state: gathered # RUN output: # ----------- # "gathered": [ # { # "connection_host": "ip", # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "8101" # }, # { # "disabled": false, # "host": "$decideOnStartup", # "index": "default", # "name": "9997" # }, # { # "connection_host": "ip", # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "default:8101", # "restrict_to_host": "default" # } # ] - name: Gathering information about TCP Cooked Inputs by Name splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: cooked name: 9997 state: gathered # RUN output: # ----------- # "gathered": [ # { # "datatype": "cooked", # "disabled": false, # "host": "$decideOnStartup", # "name": "9997", # "protocol": "tcp" # } # ] - name: Gathering information about TCP Raw Inputs splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: raw state: gathered # RUN output: # ----------- # "gathered": [ # { # "connection_host": "ip", # "disabled": false, # "host": "$decideOnStartup", # "index": "default", # "name": "8099", # "queue": "parsingQueue", # "raw_tcp_done_timeout": 10 # }, # { # "connection_host": "ip", # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "default:8100", # "queue": "parsingQueue", # "raw_tcp_done_timeout": 10, # "restrict_to_host": "default", # "source": "test_source", # "sourcetype": "test_source_type" # } # ] - name: Gathering information about TCP Raw inputs by Name splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: raw name: 8099 state: gathered # RUN output: # ----------- # "gathered": [ # { # "connection_host": "ip", # "datatype": "raw", # "disabled": false, # "host": "$decideOnStartup", # "index": "default", # "name": "8099", # "protocol": "tcp", # "queue": "parsingQueue", # "raw_tcp_done_timeout": 10 # } # ] - name: Gathering information about TCP SSL configuration splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: ssl state: gathered # RUN output: # ----------- # "gathered": [ # { # "cipher_suite": <cipher-suites>, # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "test_host" # } # ] - name: Gathering information about TCP SplunkTcpTokens splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: splunktcptoken state: gathered # RUN output: # ----------- # "gathered": [ # { # "disabled": false, # "host": "$decideOnStartup", # "index": "default", # "name": "splunktcptoken://test_token1", # "token": <token1> # }, # { # "disabled": false, # "host": "$decideOnStartup", # "index": "default", # "name": "splunktcptoken://test_token2", # "token": <token2> # } # ] # Using merged # ------------ - name: To add the TCP raw config splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: raw name: 8100 connection_host: ip disabled: true raw_tcp_done_timeout: 9 restrict_to_host: default queue: parsingQueue source: test_source sourcetype: test_source_type state: merged # RUN output: # ----------- # "after": [ # { # "connection_host": "ip", # "datatype": "raw", # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "default:8100", # "protocol": "tcp", # "queue": "parsingQueue", # "raw_tcp_done_timeout": 9, # "restrict_to_host": "default", # "source": "test_source", # "sourcetype": "test_source_type" # } # ], # "before": [ # { # "connection_host": "ip", # "datatype": "raw", # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "default:8100", # "protocol": "tcp", # "queue": "parsingQueue", # "raw_tcp_done_timeout": 10, # "restrict_to_host": "default", # "source": "test_source", # "sourcetype": "test_source_type" # } # ] - name: To add the TCP cooked config splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: cooked name: 8101 connection_host: ip disabled: false restrict_to_host: default state: merged # RUN output: # ----------- # "after": [ # { # "connection_host": "ip", # "datatype": "cooked", # "disabled": false, # "host": "$decideOnStartup", # "name": "default:8101", # "protocol": "tcp", # "restrict_to_host": "default" # } # ], # "before": [ # { # "connection_host": "ip", # "datatype": "cooked", # "disabled": true, # "host": "$decideOnStartup", # "name": "default:8101", # "protocol": "tcp", # "restrict_to_host": "default" # } # ], - name: To add the Splunk TCP token splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: splunktcptoken name: test_token state: merged # RUN output: # ----------- # "after": [ # { # "datatype": "splunktcptoken", # "name": "splunktcptoken://test_token", # "protocol": "tcp", # "token": <token> # } # ], # "before": [], - name: To add the Splunk SSL splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: ssl name: test_host root_ca: {root CA directory} server_cert: {server cretificate directory} state: merged # RUN output: # ----------- # "after": [ # { # "cipher_suite": <cipher suite>, # "datatype": "ssl", # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "test_host", # "protocol": "tcp" # } # ], # "before": [] # Using deleted # ------------- - name: To Delete TCP Raw splunk.es.splunk_data_inputs_network: config: - protocol: tcp datatype: raw name: default:8100 state: deleted # RUN output: # ----------- # "after": [], # "before": [ # { # "connection_host": "ip", # "datatype": "raw", # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "default:8100", # "protocol": "tcp", # "queue": "parsingQueue", # "raw_tcp_done_timeout": 9, # "restrict_to_host": "default", # "source": "test_source", # "sourcetype": "test_source_type" # } # ] # Using replaced # -------------- - name: Replace existing data inputs networks configuration register: result splunk.es.splunk_data_inputs_network: state: replaced config: - protocol: tcp datatype: raw name: 8100 connection_host: ip disabled: true host: "$decideOnStartup" index: default queue: parsingQueue raw_tcp_done_timeout: 10 restrict_to_host: default source: test_source sourcetype: test_source_type # RUN output: # ----------- # "after": [ # { # "connection_host": "ip", # "datatype": "raw", # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "default:8100", # "protocol": "tcp", # "queue": "parsingQueue", # "raw_tcp_done_timeout": 9, # "restrict_to_host": "default", # "source": "test_source", # "sourcetype": "test_source_type" # } # ], # "before": [ # { # "connection_host": "ip", # "datatype": "raw", # "disabled": true, # "host": "$decideOnStartup", # "index": "default", # "name": "default:8100", # "protocol": "tcp", # "queue": "parsingQueue", # "raw_tcp_done_timeout": 10, # "restrict_to_host": "default", # "source": "test_source", # "sourcetype": "test_source_type" # } # ],
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key | Description |
---|---|
after list / elements=string | The resulting configuration after module execution. Returned: when changed Sample: |
before list / elements=string | The configuration prior to the module execution. Returned: when state is merged, replaced, deleted Sample: |
gathered dictionary | Facts about the network resource gathered from the remote device as structured data. Returned: when state is gathered Sample: |
Collection links
© 2012–2018 Michael DeHaan
© 2018–2024 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/splunk/es/splunk_data_inputs_network_module.html