default location of splunk.secret is wrong?

[martijndegouw]

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 6.24
• Ruby:
• Distribution: Debian 10
• Module version: 9.0.0
• Splunk version: 8.1.0

How to reproduce (e.g Puppet code you use)

What are you seeing

I noticed that in params.pp the secret file location is set to '${homedir}/etc/splunk.secret'.

What behaviour did you expect instead

In our instances the splunk.secret file is in ${homedir}/etc/auth/. Also in splunk::enterprise::service::nix the /etc/auth/splunk.secret is used as hard-coded location for the exec creates.

Output log

Any additional information you'd like to impart

I was wondering if this default is correct, and, if yes, which magic I'm missing here. If the default location is indeed incorrect I can supply a patch for this.

[jacobevanstmx]

Both of my environments have it at ${homedir}/etc/auth/splunk.secret as you suggest.

Forwarder installed by Puppet:
VERSION=8.2.2
BUILD=87344edfcdb4
PRODUCT=splunk
PLATFORM=Linux-x86_64

Enterprise never touched by Puppet:
VERSION=8.1.4
BUILD=17f862b42a7c
PRODUCT=splunk
PLATFORM=Linux-x86_64

[martijndegouw]

The oldest version I was able to check for the splunk.secret location is version 6.3.14. This version already has this file in etc/auth.

[luedderd]

Looking through Splunk's official documentation from 7.0.0-9.3.0, the location for the splunk.secret file should be $SPLUNK_HOME/etc/auth.