Splunk Integration

Splunk provides the analysis and Puppet provides the action

You want to know what’s going on in your infrastructure, and you want to remediate fast when there is an issue. That’s challenging when you’ve got a ton of fast-moving applications. That’s where Splunk and Puppet come in. Splunk provides the data intake and analysis to tell you what’s going on while Puppet provides key operational data to improve decision making plus the ability to take immediate, automated action to resolve issues.

Richer visibility: a simple way to view and act on Puppet data

Puppet collects timely and useful inventory, change, and action data from your whole estate. With the Puppet Report Viewer for Splunk Enterprise that data is readily available in Splunk Enterprise. Recognize issues faster and correlate Puppet data in your current searches, dashboards, and alerts. Easily share Puppet data with other Splunk users like your InfoSec team. More details in the blog post: Introducing Puppet and Splunk integrations to improve reporting speed and scale.

Find it, Fix it: resolve issues faster with situational awareness and automated remediations

Splunk is the place where you analyze and visualize data to make operational and security decisions. Once you’ve recognized an issue, time to resolution is costly when you have to manually access others systems to get the information you need or to make corrective changes. Splunk is about data intake and analysis while the strength of Puppet is to dependably, safely, and repeatably take action. The Puppet Report Viewer for Splunk Enterprise speeds time to resolution in two important ways:

1. Even if Splunk has alerted you to an operational issue, you still don’t have the data you need to make a decision in the moment. This means you waste minutes or hours searching for it, which is too long for time-sensitive events. By triggering Bolt Tasks from Actionable Alerts you automatically get the information you need in seconds as soon as Splunk has recognized an issue. By the time you look at the alert, Bolt has already provided the extra context you need.
2. If incident resolution for everyday issues means tickets and emails, Puppet Bolt can help remediate without logging into servers. This is ideal for safely delegating repetitive tasks to save time on manual processes and ticket passing. This frees up the humans to deal with truly exceptional cases. Additionally, it can notify teams of action using VictorOps, providing an accelerated experience for team collaboration.

Deploy and manage Splunk Forwarders and Splunk Enterprise

In a large environment keeping critical data flowing to Splunk can be a challenge. Puppet Enterprise solves this for you with a single solution that can install Forwarders on remote systems; ensure that they are running and configured correctly; and report back to you when they are not. Puppet Enterprise also automates the installation and management of your Splunk server. See the Splunk module available from the Puppet Forge.

Get started today

• Get richer visibility, situational awareness, and automated remediation in Splunk with the Puppet Report Viewer for Splunk Enterprise Splunkbase app paired with the Splunk HEC Forge module
• Install Splunk or deploy and manage forwarders in your infrastructure with the Splunk module for Puppet