Ansible splunk.enterprise Module Example: Automate Forwarder Deployment

Red Hat announced splunk.enterprise alongside 11 other new content collections for AAP 2.7 at Red Hat Tech Day Netherlands 2026 (Bunnik, 3 June 2026). The collection targets Universal Forwarder lifecycle automation — install, configure, and manage forwarders across a fleet from a single playbook instead of touching each host by hand.

Example playbook

---
- name: Deploy and configure Splunk Universal Forwarder
  hosts: splunk_forwarders
  become: true

  vars:
    splunk_uf_version: "9.3.1"
    splunk_deployment_server: "splunk-ds.internal.example.com:8089"
    splunk_indexers:
      - "splunk-idx1.internal.example.com:9997"
      - "splunk-idx2.internal.example.com:9997"
    splunk_admin_password: "{{ vault_splunk_admin_password }}"

  tasks:
    - name: Install Splunk Universal Forwarder package
      splunk.enterprise.uf_install:
        version: "{{ splunk_uf_version }}"
        accept_license: true
        admin_password: "{{ splunk_admin_password }}"
      register: uf_install_result

    - name: Configure forwarding to indexer tier
      splunk.enterprise.uf_outputs:
        servers: "{{ splunk_indexers }}"
        state: present
      notify: restart splunk forwarder

    - name: Register forwarder with deployment server
      splunk.enterprise.uf_deploymentclient:
        deployment_server: "{{ splunk_deployment_server }}"
        state: present
      notify: restart splunk forwarder

    - name: Enable boot-start service
      splunk.enterprise.uf_boot_start:
        state: enabled

  handlers:
    - name: restart splunk forwarder
      splunk.enterprise.uf_service:
        state: restarted

What it does

The play targets a splunk_forwarders inventory group and runs four tasks in sequence. uf_install pulls down and installs the specified Universal Forwarder version, accepting the license and setting the local admin password non-interactively — the kind of step that's tedious to script by hand across dozens of hosts with shell one-liners and package managers. uf_outputs points the forwarder at your indexer tier so log data actually leaves the host, and uf_deploymentclient registers the forwarder with a deployment server so app bundles and configuration updates get pushed centrally rather than managed per-host. uf_boot_start makes sure the forwarder survives a reboot. The two configuration tasks notify a handler that restarts the forwarder service once, at the end of the play, instead of after every change.

This mirrors the pattern used across the other collections announced at the same event — microsoft.mecm and infra.mecm_ops do the same idempotent install/configure/verify loop for Windows patching, and hashicorp.vault does it for secrets rotation. The idea behind all 12 collections is the same: wrap fleet-wide lifecycle operations in modules instead of ad hoc scripts, so state is declared once and Ansible reconciles it.

Notes / Gotchas

• Store splunk_admin_password in Ansible Vault, never in plaintext vars files — treat it like any other credential.
• Module names shown here (uf_install, uf_outputs, uf_deploymentclient, uf_boot_start, uf_service) follow the naming convention Splunk Ansible content has used historically; confirm exact module names and parameters against the splunk.enterprise documentation once it publishes on Ansible Galaxy or Automation Hub for your AAP 2.7 environment.
• Group forwarder hosts by OS family if your fleet is mixed Linux/Windows — package and service handling differs enough that separate plays are cleaner than heavy when conditionals.
• Pair this with splunk.es for downstream incident response automation and splunk.itsi if you're closing the loop with Event-Driven Ansible remediation — all three shipped together as part of the same AAP 2.7 announcement.
• Run a --check pass first in any environment where forwarder restarts could interrupt log collection during a change window.

Takeaway

splunk.enterprise turns Universal Forwarder rollout and lifecycle management into a declarative, idempotent playbook instead of a per-host manual task — exactly the efficiency and scale focus Red Hat called out for the AAP 2.7 collection wave.

Related Articles

• Ansible Orchestrator Example: Wiring Splunk and ServiceNow Alert Triggers
• Ansible microsoft.scom Module Example: Alert Routing to EDA
• Ansible splunk.es Module Example: Trigger Incident Response Playbook

References

• Red Hat Ansible Automation Platform documentation
• Splunk Enterprise documentation
• Splunk IT Service Intelligence documentation