I have a couple Splunk servers in house which I manage part of the configuration through puppet. These are residing on CentOS 6 boxes.
My definition is set up as
file{ "/opt/splunk/etc/apps":
recurse => true,
purge => true,
force => true,
source => "puppet:///modules/splunk/$hostname/apps",
ensure => present,
mode => 755,
owner => splunk,
group => splunk,
notify => Service["splunk"]
}
This works well, but I'd like to exclude the saved searches file at /opt/splunk/etc/apps/myapp/local/savedsearches.conf from being overwritten and / or automatically update the copy contained within Puppet with the version kept on the local server.
Is there a ready way to do this? I looked over the documentation and didn't see anything.
You can add
ignore => "savedsearches.conf"
to the file stanza to exclude it from operations on the managed directory.