From c21a682f4ec9036c03713cc82b877899ef80fd35 Mon Sep 17 00:00:00 2001 From: Erik Horton Date: Wed, 17 Apr 2024 12:10:12 -0600 Subject: [PATCH 1/2] Use splunk_api for Remove existing HEC token --- roles/splunk_common/tasks/set_as_hec_receiver.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/roles/splunk_common/tasks/set_as_hec_receiver.yml b/roles/splunk_common/tasks/set_as_hec_receiver.yml index 59e75d91..ea23ca5c 100644 --- a/roles/splunk_common/tasks/set_as_hec_receiver.yml +++ b/roles/splunk_common/tasks/set_as_hec_receiver.yml @@ -36,12 +36,13 @@ # The REST API does not support modifying tokens in-place, so we'll need to delete/re-create - name: Remove existing HEC token - uri: - url: "{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/data/inputs/http/splunk_hec_token" + splunk_api: + url: "/services/data/inputs/http/splunk_hec_token" method: DELETE - user: "{{ splunk.admin_user }}" + cert_prefix: "{{ cert_prefix }}" + username: "{{ splunk.admin_user }}" password: "{{ splunk.password }}" - status_code: 200,404 + status_code: [200, 404] timeout: 60 use_proxy: no register: delete_hec_token From 06e778b0fcdd776937fb60c3c54cbf40fc8986a2 Mon Sep 17 00:00:00 2001 From: Erik Horton Date: Wed, 17 Apr 2024 12:19:53 -0600 Subject: [PATCH 2/2] Add svc_port --- roles/splunk_common/tasks/set_as_hec_receiver.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/splunk_common/tasks/set_as_hec_receiver.yml b/roles/splunk_common/tasks/set_as_hec_receiver.yml index ea23ca5c..c4e7333c 100644 --- a/roles/splunk_common/tasks/set_as_hec_receiver.yml +++ b/roles/splunk_common/tasks/set_as_hec_receiver.yml @@ -43,6 +43,7 @@ username: "{{ splunk.admin_user }}" password: "{{ splunk.password }}" status_code: [200, 404] + svc_port: "{{ splunk.svc_port }}" timeout: 60 use_proxy: no register: delete_hec_token