splunk_search

Statefully manage Splunk searches.

Usage

This state is used to ensure presence of splunk searches.

server-warning-message:
  splunk_search.present:
    - name: This is the splunk search name
    - search: index=main sourcetype=

saltext.splunk.states.splunk_search.present(name, profile='splunk', **kwargs)

Ensure a search is present

API Error Search:
  splunk_search.present:
    search: index=main sourcetype=blah
    template: alert_5min

The following parameters are required:

name

This is the name of the search in splunk

saltext.splunk.states.splunk_search.absent(name, profile='splunk')

Ensure a search is absent

API Error Search:
  splunk_search.absent

The following parameters are required:

name

This is the name of the search in splunk