From 476ab0cb3bb30f42d97ff3c66f1256379b5492fc Mon Sep 17 00:00:00 2001
From: devan78 <devan.willemburg@gmail.com>
Date: Thu, 25 May 2017 07:45:12 +0100
Subject: [PATCH 1/2] added listening on TCP:9997

---
 files/applications/splab_all_inputs.tar.gz | Bin 0 -> 1136 bytes
 tasks/main.yml                             |  13 +++++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 files/applications/splab_all_inputs.tar.gz

diff --git a/files/applications/splab_all_inputs.tar.gz b/files/applications/splab_all_inputs.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..12c4386309a1decf907520c809a07b4dd27c5905
GIT binary patch
literal 1136
zcmV-$1dsb4iwFSmcP3c?1MQk^Z`(Ey$NgHL;t;<mFtm;&>!A*k0><hALmv{vUW*|x
z0$O5XqO>HCRNQ>~9pwaB?Wm3uRcW{T!GJC5L{j>b$K%PmkZg9&q&yc{Q5wD9X&x7e
zJ=cDFaS*S*L$4~oq2u*E&kJI&A7Qx{pg{-1AJCT#N^O_|=;%V0*_V2|ZRdYc^t%2j
zzhI>_O^$;d^!L5UNBzSf=#&0!P^<syu$Sc7#Z%j`0!L9$uYYi-zZ>^a|2PW#4!BL+
z;5Po}`k$@t%Ou6Y{{CPvh^I~}G@D7D!V$R6bN7$<vDD80lo{60BCz}VAN9k4{C^vK
zU;k1xF$5l=e;j+He;aJoKVw%<9Rs`TABSN``nSP@^uH<VeO<`Mv{A)>ZoU3}H~dzA
z--~^U|61V?^##qDO6KQRf-jHuRtI~K<T6)Bd)+7;M*Vp2jRSCKEg)kHerI+wHjZ8x
zRq_|Gziwy8k>*D4ZJtuR$kn}PnB@1LNSU6`a;DPN$wNCl-%ybHc(%@e`|zKb724VV
z`>y9l<p0~?f%>10hHpQN9@$2<#Sgx-|Bu)8_izA^|8Ij~ngXg1X3n9K8h<eZ*LkUc
z6$NCRry4|t#X>_W6i-a9uF2*8N2s0uD1IZ!zs>{VzbIPE|Ke)l()@3OuG58ab!*jh
zw~C9)QZXa)3@(J^PS<hHM21gE%Bdst`K`%Kg3viDMOA(!w3ta=72=rU5`T^D=(?@{
zlqZ5;aRqpdWM!7jxtcnxH1k}c?OT4uGWaZ{<cnFUE}fL?M2Vv6$q~F4+HmX=+KMd6
z7b3d^tSvJdE>ym_Z3NFRF+Ai-170@y{p4T}$FYOW>Qy~n5BvPwPyOd%WBxC=VGZW~
zEW7Xj!!V}zf2~lj|LvyV7CfzuZT>&<`|I()8;9io+W_7FuqdQRDv$q4qDz%faJ3NH
zI!uke8hvz<aIMjKD$Y_kfHU|FrY~WsgyGd8OVJ;{gd$&}d!IT^x7&r$r_sj=O#VI@
zjj@u-Rh#RA>#4)P+I>G(r?1hcFPxSA$?5TlwJcO#)EZ4rhabm(9G`x$mPWBmqr+d+
zn!i6je)m^ZtIYE+WqrM${v3TCPll7x_@G)<Aj4{zgi_m;M9=e5rZD4RUyOmtA;Bks
z_pay6u7g$JY_PySuDgQ=JUBeu=uxZs*Ux{MCrmal`?t@3FN!zvzd=OvzYWeX>f5&w
z++Bne^}?R-Eb`Qdg$?JtU=T(FA64mjuLtgHjLmJ>XD_@9;~skX0BdmRwenBH#{8d&
ztm*%N?H>OHVMOs?E8MI9ld^rAY|sC#`+s!*l>cjmiB0R_XNg{%+q56xC;*mS!)o)b
ztFk4_j17BOn%b`_7ibei<i~$?Hs*g7_BFc#tWx|t?f*SoF3A74K#l$lW`DQG|E}+?
z|NkfKlmBmpDtr6yeC%^~h#&}pAP9mW2!bF8f*=TjAP9mW2!bGpo%siRRp!<JPyhht
CwqF(i

literal 0
HcmV?d00001

diff --git a/tasks/main.yml b/tasks/main.yml
index ed51b1f..2e2ba18 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -65,6 +65,19 @@
     - "binaries/splunk-*-*-Linux-x86_64.tgz"
   become: yes
 
+- name: Install the Splunk generic input application  
+  unarchive:
+    src: "{{ item }}"
+    dest: "/opt/splunk/etc/apps/"
+    creates: "/opt/splunk/etc/apps/splab_all_inputs"
+    owner: "{{ splunk_user_name }}"
+    group: "{{ splunk_group_name }}"
+  with_fileglob:
+    - "applications/splab_all_inputs.tar.gz"
+  become: yes
+
+
+
 - name: Enable Splunk to start at boot
   command: "/opt/splunk/bin/splunk enable boot-start -user splunk --accept-license"
   become: yes

From 5797b5f5d8646949bd02d9c7301ae73306398e9e Mon Sep 17 00:00:00 2001
From: devan78 <devan.willemburg@gmail.com>
Date: Fri, 26 May 2017 11:11:33 +0100
Subject: [PATCH 2/2] Renamed default Splunk cooked input to something sensible

---
 files/applications/splab_all_inputs.tar.gz    | Bin 1136 -> 0 bytes
 files/applications/splab_splunk_inputs.tar.gz | Bin 0 -> 1156 bytes
 tasks/main.yml                                |   6 ++----
 3 files changed, 2 insertions(+), 4 deletions(-)
 delete mode 100644 files/applications/splab_all_inputs.tar.gz
 create mode 100644 files/applications/splab_splunk_inputs.tar.gz

diff --git a/files/applications/splab_all_inputs.tar.gz b/files/applications/splab_all_inputs.tar.gz
deleted file mode 100644
index 12c4386309a1decf907520c809a07b4dd27c5905..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1136
zcmV-$1dsb4iwFSmcP3c?1MQk^Z`(Ey$NgHL;t;<mFtm;&>!A*k0><hALmv{vUW*|x
z0$O5XqO>HCRNQ>~9pwaB?Wm3uRcW{T!GJC5L{j>b$K%PmkZg9&q&yc{Q5wD9X&x7e
zJ=cDFaS*S*L$4~oq2u*E&kJI&A7Qx{pg{-1AJCT#N^O_|=;%V0*_V2|ZRdYc^t%2j
zzhI>_O^$;d^!L5UNBzSf=#&0!P^<syu$Sc7#Z%j`0!L9$uYYi-zZ>^a|2PW#4!BL+
z;5Po}`k$@t%Ou6Y{{CPvh^I~}G@D7D!V$R6bN7$<vDD80lo{60BCz}VAN9k4{C^vK
zU;k1xF$5l=e;j+He;aJoKVw%<9Rs`TABSN``nSP@^uH<VeO<`Mv{A)>ZoU3}H~dzA
z--~^U|61V?^##qDO6KQRf-jHuRtI~K<T6)Bd)+7;M*Vp2jRSCKEg)kHerI+wHjZ8x
zRq_|Gziwy8k>*D4ZJtuR$kn}PnB@1LNSU6`a;DPN$wNCl-%ybHc(%@e`|zKb724VV
z`>y9l<p0~?f%>10hHpQN9@$2<#Sgx-|Bu)8_izA^|8Ij~ngXg1X3n9K8h<eZ*LkUc
z6$NCRry4|t#X>_W6i-a9uF2*8N2s0uD1IZ!zs>{VzbIPE|Ke)l()@3OuG58ab!*jh
zw~C9)QZXa)3@(J^PS<hHM21gE%Bdst`K`%Kg3viDMOA(!w3ta=72=rU5`T^D=(?@{
zlqZ5;aRqpdWM!7jxtcnxH1k}c?OT4uGWaZ{<cnFUE}fL?M2Vv6$q~F4+HmX=+KMd6
z7b3d^tSvJdE>ym_Z3NFRF+Ai-170@y{p4T}$FYOW>Qy~n5BvPwPyOd%WBxC=VGZW~
zEW7Xj!!V}zf2~lj|LvyV7CfzuZT>&<`|I()8;9io+W_7FuqdQRDv$q4qDz%faJ3NH
zI!uke8hvz<aIMjKD$Y_kfHU|FrY~WsgyGd8OVJ;{gd$&}d!IT^x7&r$r_sj=O#VI@
zjj@u-Rh#RA>#4)P+I>G(r?1hcFPxSA$?5TlwJcO#)EZ4rhabm(9G`x$mPWBmqr+d+
zn!i6je)m^ZtIYE+WqrM${v3TCPll7x_@G)<Aj4{zgi_m;M9=e5rZD4RUyOmtA;Bks
z_pay6u7g$JY_PySuDgQ=JUBeu=uxZs*Ux{MCrmal`?t@3FN!zvzd=OvzYWeX>f5&w
z++Bne^}?R-Eb`Qdg$?JtU=T(FA64mjuLtgHjLmJ>XD_@9;~skX0BdmRwenBH#{8d&
ztm*%N?H>OHVMOs?E8MI9ld^rAY|sC#`+s!*l>cjmiB0R_XNg{%+q56xC;*mS!)o)b
ztFk4_j17BOn%b`_7ibei<i~$?Hs*g7_BFc#tWx|t?f*SoF3A74K#l$lW`DQG|E}+?
z|NkfKlmBmpDtr6yeC%^~h#&}pAP9mW2!bF8f*=TjAP9mW2!bGpo%siRRp!<JPyhht
CwqF(i

diff --git a/files/applications/splab_splunk_inputs.tar.gz b/files/applications/splab_splunk_inputs.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..615804e2ad92817c2584c9c1350aad1a5d6f8071
GIT binary patch
literal 1156
zcmV-~1bh1*iwFS0{wG-g1MQk^Z`(Ey$MagB;t;<mFm#TdRR?haWA%Wc4+#>l#Sj<)
zEzvPiSrSOfuD|_`a*}S2Bipg3bld$}K#_E!DE;q_N6M;5+2}?UX_<Y!5m`}cb#ioI
zY}<|;8>(#>R9oBim)kqQ@f^qTBgYFJu${<{{38es-H~;aN;8RFN%)LqbCITeIx6Mu
zBRe!3k89ewdya?gzXY{L|B=WJ>H|CL@8W6FzY*5ypYSm&Q++TW*joQ6iX7iY{T;_8
z{TpGO{%Ibw^ne+_=x*;8|3Mg#{!Oq>|0&ljVVWJv1$NK>jvG+?H$tuccLPD&9N6O?
z_&&nA_zzugMSm{{+#|3L_LMdJ&-J%j&?|~m#7v7k`#I$^o<hOpR49c9lx1BHEf&XI
zDd>XaEP+$FhM!>g8s<`HUhT4EDzev5<Z~`zXj!dR3;Lh?p9V1a<D!3sjbOW(){BCx
zp~b%yxzyO4S}4t@*3$ms^8CVB7BVlMG#Xs?K3)BKe)-W@YRNJ+&gJw;^AG3e?|-ja
zP4oO~`E<LVf9rp_8uSMJt5Yytg$$czDU^y!1!|I)X#yh-Y?N})ImGxT@Y&UbNuIz=
z@HzU2=H_*M-`V2D;qIdzHL8DY{8xp*zR|xq{+%#djepnmDE^z^nia)KDTdYz9UTK6
z-7stiZP%LSi563i`;OlU!j6lx^0xD)W503m`OweJg()kuc*5oOmv^uQy!@pfo4DiY
z`XBXe$9Y!g^INhh{;}R$iGSC%BZ~hfxHhqm!{b9BzjTL)MyXr>IaCJN6#rfrKCJ(s
zg^B+lawz_rpoJ5Ft4e)9xxvUSZcACs24E~wZnZEyhzuV;O^23HH}@u3_jbV)0w#mt
z@tIJ<RLABZ`V>whx~63|x^MrI#{z3>34hBstkjcSqU}2)0DO5+z)HA^r6}~WtoR_X
zIL0oat;pgW=Nq?GrLGl>Wj?*X37(%bnV6~_FB|-FaoRzz`b&A@w6V`G{nmdR>f--U
zYe2iN|G2j2(E3jk)ak$6-G2x$`QP_z^!Fe1$GXom^FPlCDE~LX^-_8r7pEsDolYkj
zT8U6*nPZvWU%G$9Kg-7aUy8klfM?`?-w!GOH^DagXKc2Y5A3eLhyO_bCfG**YDIew
z4|s<Dq3x0WO|ZTGm;K(mkNxM|!&G>+^<T8AKc;_L|7(O^k^s)^K~MPdGZy~EG%WH`
zRto|d=ZV4@Hy#!W5+Ql4bGe|p@IS(~<Ny6n0lrPso$q09TK}_ymG}?5h~mEy&QM%X
zoXL1{W8%Miyxcj4I8SrgJ#K|TFZ810w-&&ev4D(C`FFEB$LPM&vgEJeWYx|%k>Xk%
zKRzY7`S88&3`_a?6A4q3QO;ztJb7k(^DQN#=kwI>f1f|vKW6jzzxw^(aXgCuMi`i3
z9skcKTyit)1G)gPYyr!~cU2vmvrL<xy)dj6a8uO+=Iane9zhTUK@bE%5ClOG1VIo4
WK@bE%5ClQ|2>c0Shb+$kPyhf81X}L^

literal 0
HcmV?d00001

diff --git a/tasks/main.yml b/tasks/main.yml
index 2e2ba18..565ab99 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -69,15 +69,13 @@
   unarchive:
     src: "{{ item }}"
     dest: "/opt/splunk/etc/apps/"
-    creates: "/opt/splunk/etc/apps/splab_all_inputs"
+    creates: "/opt/splunk/etc/apps/splab_splunk_inputs"
     owner: "{{ splunk_user_name }}"
     group: "{{ splunk_group_name }}"
   with_fileglob:
-    - "applications/splab_all_inputs.tar.gz"
+    - "applications/splab_splunk_inputs.tar.gz"
   become: yes
 
-
-
 - name: Enable Splunk to start at boot
   command: "/opt/splunk/bin/splunk enable boot-start -user splunk --accept-license"
   become: yes