splunk::forwarder class Splunk forwarder version 7.2.4.2 works idempotently with no errors Failure/Error: apply_manifest(pp, catch_failures: true) Beaker::Host::CommandFailure: Host 'ubuntu2004-64-puppet7.example.com' exited with 6 running: puppet apply --verbose --detailed-exitcodes /tmp/apply_manifest_180547347.wv1POB.pp Last 10 lines of output were: Error: /Stage[main]/Splunk::Forwarder::Service/Service[SplunkForwarder]/ensure: change from 'stopped' to 'running' failed: Systemd start for SplunkForwarder failed! journalctl log for SplunkForwarder: -- Logs begin at Thu 2024-10-24 17:57:13 UTC, end at Thu 2024-10-24 18:05:52 UTC. -- -- No entries -- �[mNotice: /Stage[main]/Splunk::Forwarder::Service/Service[SplunkForwarder]: Triggered 'refresh' from 1 event Info: Class[Splunk::Forwarder::Service]: Unscheduling all events on Class[Splunk::Forwarder::Service] Info: Class[Splunk::Forwarder]: Unscheduling all events on Class[Splunk::Forwarder] Info: Stage[main]: Unscheduling all events on Stage[main] �[mNotice: Applied catalog in 2.92 seconds

splunk::forwarder class Splunk forwarder version 7.2.4.2 Service "SplunkForwarder" is expected to be enabled Failure/Error: it { is_expected.to be_enabled } expected Service "SplunkForwarder" to be enabled

splunk::forwarder class Splunk forwarder version 7.2.4.2 Service "SplunkForwarder" is expected to be running Failure/Error: it { is_expected.to be_running } expected Service "SplunkForwarder" to be running

splunk::forwarder class Splunk forwarder version 9.0.0 works idempotently with no errors Failure/Error: apply_manifest(pp, catch_failures: true) Beaker::Host::CommandFailure: Host 'ubuntu2004-64-puppet7.example.com' exited with 6 running: puppet apply --verbose --detailed-exitcodes /tmp/apply_manifest_180556869.unFOMb.pp Last 10 lines of output were: Error: /Stage[main]/Splunk::Forwarder::Service/Service[SplunkForwarder]/ensure: change from 'stopped' to 'running' failed: Systemd start for SplunkForwarder failed! journalctl log for SplunkForwarder: -- Logs begin at Thu 2024-10-24 17:57:13 UTC, end at Thu 2024-10-24 18:06:01 UTC. -- -- No entries -- �[mNotice: /Stage[main]/Splunk::Forwarder::Service/Service[SplunkForwarder]: Triggered 'refresh' from 1 event Info: Class[Splunk::Forwarder::Service]: Unscheduling all events on Class[Splunk::Forwarder::Service] Info: Class[Splunk::Forwarder]: Unscheduling all events on Class[Splunk::Forwarder] Info: Stage[main]: Unscheduling all events on Stage[main] �[mNotice: Applied catalog in 2.97 seconds

splunk::forwarder class Splunk forwarder version 9.0.0 Service "SplunkForwarder" is expected to be enabled Failure/Error: it { is_expected.to be_enabled } expected Service "SplunkForwarder" to be enabled

splunk::forwarder class Splunk forwarder version 9.0.0 Service "SplunkForwarder" is expected to be running Failure/Error: it { is_expected.to be_running } expected Service "SplunkForwarder" to be running

splunk::forwarder class default parameters works idempotently with no errors Failure/Error: apply_manifest(pp, catch_changes: true) Beaker::Host::CommandFailure: Host 'ubuntu2004-64-puppet7.example.com' exited with 2 running: puppet apply --verbose --detailed-exitcodes /tmp/apply_manifest_180611499.iMx3cX.pp Last 10 lines of output were: Warning: Secrets file NOT found in /opt/splunkforwarder/etc/auth/splunk.secret Warning: Secrets file NOT found in /opt/splunkforwarder/etc/auth/splunk.secret Warning: Secrets file NOT found in /opt/splunkforwarder/etc/auth/splunk.secret Warning: Secrets file NOT found in /opt/splunkforwarder/etc/auth/splunk.secret Info: Class[Splunk::Forwarder::Config]: Scheduling refresh of Class[Splunk::Forwarder::Service] Warning: Secrets file NOT found in /opt/splunkforwarder/etc/auth/splunk.secret Info: Class[Splunk::Forwarder::Service]: Scheduling refresh of Service[SplunkForwarder] �[mNotice: /Stage[main]/Splunk::Forwarder::Service/Service[SplunkForwarder]/ensure: ensure changed 'stopped' to 'running' Info: /Stage[main]/Splunk::Forwarder::Service/Service[SplunkForwarder]: Unscheduling refresh on Service[SplunkForwarder] �[mNotice: Applied catalog in 0.22 seconds

splunk::forwarder class default parameters File "/opt/splunkforwarder/etc/system/local/outputs.conf" content is expected to match /^sslPassword = \$7\$/ Failure/Error: its(:content) { is_expected.to match %r{^sslPassword = \$7\$} } expected "[default]\ndefaultGroup=splunk_9997\n\n[tcpout:splunk_9997]\nserver=splunk:9997\n\n[tcpout:splunkcloud]\nsslPassword=super_secure_password\n" to match /^sslPassword = \$7\$/ Diff: @@ -1,8 +1,15 @@ -/^sslPassword = \$7\$/ +[default] +defaultGroup=splunk_9997 + +[tcpout:splunk_9997] +server=splunk:9997 + +[tcpout:splunkcloud] +sslPassword=super_secure_password

splunk::forwarder class purging purge_outputs => false works idempotently with no errors Failure/Error: apply_manifest(pp, catch_changes: true) Beaker::Host::CommandFailure: Host 'ubuntu2004-64-puppet7.example.com' exited with 2 running: puppet apply --verbose --detailed-exitcodes /tmp/apply_manifest_180640432.8cfR98.pp Last 10 lines of output were: Info: /Stage[main]/Splunk::Forwarder::Config/File[/opt/splunkforwarder/etc/system/local/server.conf]: Scheduling refresh of Class[Splunk::Forwarder::Service] Info: /Stage[main]/Splunk::Forwarder::Config/File[/opt/splunkforwarder/etc/system/local/server.conf]: Scheduling refresh of Class[Splunk::Forwarder::Service] Info: /Stage[main]/Splunk::Forwarder::Config/File[/opt/splunkforwarder/etc/system/local/server.conf]: Scheduling refresh of Class[Splunk::Forwarder::Service] Info: /Stage[main]/Splunk::Forwarder::Config/File[/opt/splunkforwarder/etc/system/local/server.conf]: Scheduling refresh of Class[Splunk::Forwarder::Service] Info: /Stage[main]/Splunk::Forwarder::Config/File[/opt/splunkforwarder/etc/system/local/server.conf]: Scheduling refresh of Class[Splunk::Forwarder::Service] Info: /Stage[main]/Splunk::Forwarder::Config/File[/opt/splunkforwarder/etc/system/local/server.conf]: Scheduling refresh of Class[Splunk::Forwarder::Service] Info: Class[Splunk::Forwarder::Config]: Scheduling refresh of Class[Splunk::Forwarder::Service] Info: Class[Splunk::Forwarder::Service]: Scheduling refresh of Service[SplunkForwarder] �[mNotice: /Stage[main]/Splunk::Forwarder::Service/Service[SplunkForwarder]: Triggered 'refresh' from 1 event �[mNotice: Applied catalog in 41.28 seconds