diff --git a/roles/splunk/tasks/configure_facl.yml b/roles/splunk/tasks/configure_facl.yml
index 29c0a75a..5df66358 100644
--- a/roles/splunk/tasks/configure_facl.yml
+++ b/roles/splunk/tasks/configure_facl.yml
@@ -22,7 +22,7 @@
 
     - name: Add setfacl to logrotate script
       lineinfile:
-        path: "{{ logrotate_file }}"
+        path: "{{ logrotate_file | default('/etc/logrotate.d/syslog') }}"
         insertbefore: 'endscript'
         line: '        /usr/bin/setfacl -Rm u:{{ splunk_nix_user }}:rx /var/log'
       become: True