From c409fe5578e857182b2f6a60f9c88baa7278e69b Mon Sep 17 00:00:00 2001
From: Mike Chambers <mike@Mikes-MacBook-Pro-5.local>
Date: Mon, 6 Aug 2018 08:47:12 +1000
Subject: [PATCH 1/2] Fixed line break in multiple user data hosts entry.

---
 templates/splunk-enterprise.template | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/templates/splunk-enterprise.template b/templates/splunk-enterprise.template
index ec36394..57dd24b 100644
--- a/templates/splunk-enterprise.template
+++ b/templates/splunk-enterprise.template
@@ -741,7 +741,7 @@
                                 "export SPLUNK_USER=splunk\n",
                                 "export SPLUNK_BIN=/opt/splunk/bin/splunk\n",
                                 "export SPLUNK_HOME=/opt/splunk\n",
-                                "printf '%s\t%s\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n",
+                                "printf '%s\t%s\\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n",
                                 "hostname splunksearch\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
@@ -1032,7 +1032,7 @@
                                 "export SPLUNK_USER=splunk\n",
                                 "export SPLUNK_BIN=/opt/splunk/bin/splunk\n",
                                 "export SPLUNK_HOME=/opt/splunk\n",
-                                "printf '%s\t%s\n' \"$LOCALIP\" 'splunklicense' >> /etc/hosts\n",
+                                "printf '%s\t%s\\n' \"$LOCALIP\" 'splunklicense' >> /etc/hosts\n",
                                 "hostname splunklicense\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
@@ -1309,7 +1309,7 @@
                                 "export SPLUNK_USER=splunk\n",
                                 "export SPLUNK_BIN=/opt/splunk/bin/splunk\n",
                                 "export SPLUNK_HOME=/opt/splunk\n",
-                                "printf '%s\t%s\n' \"$LOCALIP\" 'splunk-shc-deployer' >> /etc/hosts\n",
+                                "printf '%s\t%s\\n' \"$LOCALIP\" 'splunk-shc-deployer' >> /etc/hosts\n",
                                 "hostname splunk-shc-deployer\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
@@ -1561,7 +1561,7 @@
                                 "export SPLUNK_USER=splunk\n",
                                 "export SPLUNK_BIN=/opt/splunk/bin/splunk\n",
                                 "export SPLUNK_HOME=/opt/splunk\n",
-                                "printf '%s\t%s\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n",
+                                "printf '%s\t%s\\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n",
                                 "hostname splunksearch\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
@@ -1748,7 +1748,7 @@
                                 "export SPLUNK_USER=splunk\n",
                                 "export SPLUNK_BIN=/opt/splunk/bin/splunk\n",
                                 "export SPLUNK_HOME=/opt/splunk\n",
-                                "printf '%s\t%s\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n",
+                                "printf '%s\t%s\\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n",
                                 "hostname splunksearch\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
@@ -1943,7 +1943,7 @@
                                 "export SPLUNK_USER=splunk\n",
                                 "export SPLUNK_BIN=/opt/splunk/bin/splunk\n",
                                 "export SPLUNK_HOME=/opt/splunk\n",
-                                "printf '%s\t%s\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n",
+                                "printf '%s\t%s\\n' \"$LOCALIP\" 'splunksearch' >> /etc/hosts\n",
                                 "hostname splunksearch\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",

From 5af044d0b84366acc6284ed0318b663b05d59fb6 Mon Sep 17 00:00:00 2001
From: Mike Chambers <mike@Mikes-MacBook-Pro-5.local>
Date: Tue, 7 Aug 2018 08:59:23 +1000
Subject: [PATCH 2/2] Adjustments for new AMI (workarounds until new AMI
 produced)

---
 templates/splunk-enterprise.template | 67 ++++++++++++++++++++--------
 1 file changed, 49 insertions(+), 18 deletions(-)

diff --git a/templates/splunk-enterprise.template b/templates/splunk-enterprise.template
index 57dd24b..723bab9 100644
--- a/templates/splunk-enterprise.template
+++ b/templates/splunk-enterprise.template
@@ -745,14 +745,18 @@
                                 "hostname splunksearch\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
+                                "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n",
                                 "touch $SPLUNK_HOME/etc/.ui_login\n",
                                 "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n",
-                                "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n",
+                                "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n",
+                                "# Force the Splunk startup script to run.\n",
+                                "service splunk start\n",
+                                "service splunk stop\n",
                                 "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ",
                                 {
                                     "Ref": "SplunkAdminPassword"
                                 },
-                                " -role admin -auth admin:changeme\n",
+                                " -role admin -auth admin:$INSTANCEID\n",
                                 "# Increase splunkweb connection timeout with splunkd\n",
                                 "mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local\n",
                                 "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end\n",
@@ -771,7 +775,6 @@
                                 "indexAndForward = false\n",
                                 "\n",
                                 "[tcpout:indexer_cluster_peers]\n",
-                                "autoLB = true\n",
                                 "indexerDiscovery = cluster_master\n",
                                 "\n",
                                 "[indexer_discovery:cluster_master]\n",
@@ -858,6 +861,7 @@
                                         ""
                                     ]
                                 },
+                                "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername splunksearch\n",
                                 "service splunk restart\n",
                                 "/opt/aws/bin/cfn-signal -e $? --stack ",
                                 {
@@ -1036,14 +1040,18 @@
                                 "hostname splunklicense\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
+                                "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n",
                                 "touch $SPLUNK_HOME/etc/.ui_login\n",
                                 "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n",
-                                "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n",
+                                "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n",
+                                "# Force the Splunk startup script to run.\n",
+                                "service splunk start\n",
+                                "service splunk stop\n",
                                 "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ",
                                 {
                                     "Ref": "SplunkAdminPassword"
                                 },
-                                " -role admin -auth admin:changeme\n",
+                                " -role admin -auth admin:$INSTANCEID\n",
                                 "# Install files from the metadata\n",
                                 "/opt/aws/bin/cfn-init -v ",
                                 "         --stack ",
@@ -1077,7 +1085,6 @@
                                 "indexAndForward = false\n",
                                 "\n",
                                 "[tcpout:indexer_cluster_peers]\n",
-                                "autoLB = true\n",
                                 "indexerDiscovery = cluster_master\n",
                                 "\n",
                                 "[indexer_discovery:cluster_master]\n",
@@ -1181,6 +1188,7 @@
                                     ]
                                 },
                                 "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/master-apps\n",
+                                "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername splunklicence\n",
                                 "service splunk restart\n",
                                 "/opt/aws/bin/cfn-signal -e $? --stack ",
                                 {
@@ -1313,14 +1321,18 @@
                                 "hostname splunk-shc-deployer\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
+                                "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n",
                                 "touch $SPLUNK_HOME/etc/.ui_login\n",
                                 "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n",
-                                "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n",
+                                "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n",
+                                "# Force the Splunk startup script to run.\n",
+                                "service splunk start\n",
+                                "service splunk stop\n",
                                 "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ",
                                 {
                                     "Ref": "SplunkAdminPassword"
                                 },
-                                " -role admin -auth admin:changeme\n",
+                                " -role admin -auth admin:$INSTANCEID\n",
                                 "# Increase splunkweb connection timeout with splunkd\n",
                                 "mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local\n",
                                 "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end\n",
@@ -1350,7 +1362,6 @@
                                 "indexAndForward = false\n",
                                 "\n",
                                 "[tcpout:indexer_cluster_peers]\n",
-                                "autoLB = true\n",
                                 "indexerDiscovery = cluster_master\n",
                                 "\n",
                                 "[indexer_discovery:cluster_master]\n",
@@ -1382,7 +1393,6 @@
                                 "indexAndForward = false\n",
                                 "\n",
                                 "[tcpout:indexer_cluster_peers]\n",
-                                "autoLB = true\n",
                                 "indexerDiscovery = cluster_master\n",
                                 "\n",
                                 "[indexer_discovery:cluster_master]\n",
@@ -1439,6 +1449,7 @@
                                     ]
                                 },
                                 "chown -R $SPLUNK_USER:$SPLUNK_USER $SPLUNK_HOME/etc/shcluster/apps\n",
+                                "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername splunk-shc-deployer\n",
                                 "service splunk start\n",
                                 "sudo -u $SPLUNK_USER $SPLUNK_BIN edit licenser-localslave ",
                                 "-master_uri https://",
@@ -1565,14 +1576,18 @@
                                 "hostname splunksearch\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
+                                "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n",
                                 "touch $SPLUNK_HOME/etc/.ui_login\n",
                                 "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n",
-                                "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n",
+                                "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n",
+                                "# Force the Splunk startup script to run.\n",
+                                "service splunk start\n",
+                                "service splunk stop\n",
                                 "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ",
                                 {
                                     "Ref": "SplunkAdminPassword"
                                 },
-                                " -role admin -auth admin:changeme\n",
+                                " -role admin -auth admin:$INSTANCEID\n",
                                 "# Increase splunkweb connection timeout with splunkd\n",
                                 "cat >$SPLUNK_HOME/etc/system/local/web.conf <<end\n",
                                 "[settings]\n",
@@ -1642,6 +1657,7 @@
                                     "Ref": "SplunkClusterSecret"
                                 },
                                 "\n",
+                                "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername splunksearch\n",
                                 "service splunk restart\n",
                                 "/opt/aws/bin/cfn-signal -e $? --stack ",
                                 {
@@ -1752,14 +1768,18 @@
                                 "hostname splunksearch\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
+                                "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n",
                                 "touch $SPLUNK_HOME/etc/.ui_login\n",
                                 "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n",
-                                "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n",
+                                "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n",
+                                "# Force the Splunk startup script to run.\n",
+                                "service splunk start\n",
+                                "service splunk stop\n",
                                 "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ",
                                 {
                                     "Ref": "SplunkAdminPassword"
                                 },
-                                " -role admin -auth admin:changeme\n",
+                                " -role admin -auth admin:$INSTANCEID\n",
                                 "# Increase splunkweb connection timeout with splunkd\n",
                                 "cat >$SPLUNK_HOME/etc/system/local/web.conf <<end\n",
                                 "[settings]\n",
@@ -1829,6 +1849,7 @@
                                     "Ref": "SplunkClusterSecret"
                                 },
                                 "\n",
+                                "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername splunksearch\n",
                                 "service splunk restart\n",
                                 "/opt/aws/bin/cfn-signal -e $? --stack ",
                                 {
@@ -1947,14 +1968,18 @@
                                 "hostname splunksearch\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
+                                "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n",
                                 "touch $SPLUNK_HOME/etc/.ui_login\n",
                                 "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n",
-                                "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n",
+                                "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n",
+                                "# Force the Splunk startup script to run.\n",
+                                "service splunk start\n",
+                                "service splunk stop\n",
                                 "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ",
                                 {
                                     "Ref": "SplunkAdminPassword"
                                 },
-                                " -role admin -auth admin:changeme\n",
+                                " -role admin -auth admin:$INSTANCEID\n",
                                 "# Increase splunkweb connection timeout with splunkd\n",
                                 "cat >$SPLUNK_HOME/etc/system/local/web.conf <<end\n",
                                 "[settings]\n",
@@ -2031,6 +2056,7 @@
                                     "Ref": "SplunkClusterSecret"
                                 },
                                 "\n",
+                                "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername splunksearch\n",
                                 "service splunk restart\n",
                                 "# Bootstrap SHC captain\n",
                                 "sudo -u $SPLUNK_USER $SPLUNK_BIN bootstrap shcluster-captain ",
@@ -2188,14 +2214,18 @@
                                 "export SPLUNK_HOME=/opt/splunk\n",
                                 "# Stop Splunk and reset password\n",
                                 "service splunk stop\n",
+                                "sed -i '/guid/d' $SPLUNK_HOME/etc/instance.cfg\n",
                                 "touch $SPLUNK_HOME/etc/.ui_login\n",
                                 "mv $SPLUNK_HOME/etc/passwd $SPLUNK_HOME/etc/passwd.bak\n",
-                                "sed -i 's/force-change-pass true//' /etc/init.d/splunk\n",
+                                "sed -i 's/ENFORCE_PWD_CHANGE=1//' /etc/init.d/splunk\n",
+                                "# Force the Splunk startup script to run.\n",
+                                "service splunk start\n",
+                                "service splunk stop\n",
                                 "sudo -u $SPLUNK_USER $SPLUNK_BIN edit user admin -password ",
                                 {
                                     "Ref": "SplunkAdminPassword"
                                 },
-                                " -role admin -auth admin:changeme\n",
+                                " -role admin -auth admin:$INSTANCEID\n",
                                 "# Increase splunkweb connection timeout with splunkd\n",
                                 "mkdir -p $SPLUNK_HOME/etc/apps/base-autogenerated/local\n",
                                 "cat >>$SPLUNK_HOME/etc/apps/base-autogenerated/local/web.conf <<end\n",
@@ -2265,6 +2295,7 @@
                                     "Ref": "SplunkClusterSecret"
                                 },
                                 "\n",
+                                "sudo -u $SPLUNK_USER $SPLUNK_BIN set servername indexer-$site\n",
                                 "service splunk restart\n",
                                 "/opt/aws/bin/cfn-signal -s true --stack ",
                                 {