icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Puppet Report Viewer app for Splunk
SHA256 checksum (puppet-report-viewer-app-for-splunk_400.tgz) d27f88023184fd853843ffc76f97fe204a15ee79441b0676b3ccebf4b6bf3022 SHA256 checksum (puppet-report-viewer-app-for-splunk_312.tgz) 57319fecbefc2c7c728ac9c690d0770f771e9b887dc12a11cad27ac8e5b95a96 SHA256 checksum (puppet-report-viewer-app-for-splunk_311.tgz) 1842305b86947791587c731580bcf8710bbfc5d52e268cf0b432dbd1e11fa126 SHA256 checksum (puppet-report-viewer-app-for-splunk_310.tgz) 71d3b2fa69811840868e06c60175368f5d491936f2ba1583c75f3ec42b74614c SHA256 checksum (puppet-report-viewer-app-for-splunk_303.tgz) 924c86678715adf37d337b371ad572eae85f7a2df584d5ca481e536713374cd2 SHA256 checksum (puppet-report-viewer-app-for-splunk_302.tgz) 7234808bdc9fa86a6242b5db3b2cafb364d27007fd705e39a21af6b2fa5f29b5 SHA256 checksum (puppet-report-viewer-app-for-splunk_301.tgz) 2e5117c5d4862821146dedffe1a53b75fe35a40854e548770121ece14b75f336
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Puppet Report Viewer app for Splunk

This app integrates Puppet Enterprise or Puppet open source with Splunk to:

* Send Puppet node inventory, node facts, report summaries and report details into Splunk from one or more Puppet primary servers.
* Automate taking action by triggering Bolt tasks from Actionable Alerts (Puppet Enterprise only, requires the Puppet Alert Actions add-on for Splunk).
* Maintain an audit log of Bolt actions that were run.
* Trend Puppet inventory and fact data over time.
* Power example dashboards and searches on Puppet data.
* Provide operational metrics and dashboards for your Puppet deployment.

Use cases:

* Share Puppet's rich, detailed inventory and change data with other teams for searches, dashboards and alerts.
* Trend data over time to track progress or detect issues.
* Make decisions faster by automatically triggering gathering the information you need to make a decision after Splunk has recognized an issue (Puppet Enterprise only).
* Resolve issues faster by automatically triggering remediations after Splunk has recognized an issue (Puppet Enterprise only).
* Monitor the health of your Puppet deployment.
* Log and audit what ad hoc actions were run.
* If you also need to deploy, configure and manage Splunk forwarders there is a Puppet module for that available here (https://forge.puppet.com/puppet/splunk).

Included are:

* Source types for Puppet summary reports, detailed reports, facts, PE orchestrator and activity events, as well as Puppet Bolt runs.
* Actionable Alert to generate Puppet Detailed Reports on demand.
* Example dashboards to see analysis options of the content provided in a report.

This app requires installing the Splunk HEC Report Processor (https://forge.puppet.com/puppetlabs/splunk_hec) on the Puppet Servers one wishes to collect data from.

Puppet Report Viewer

Table of Contents
  1. Description
  2. Configuration
  3. Advanced Configuration
  4. Troubleshooting and Verification


This Splunk app provides views into the status of Puppet installations that are configured to send reports and metrics with the splunk_hec and puppet_metrics_collector Puppet modules.


Once the application has been installed follow the steps below to configure the Puppet Report Viewer:

Create an Splunk HEC token for the app:

  • Select Puppet Report Viewer from the App dropdown in the Splunk console.
  • Navigate to Settings > Data Input.
  • Add a new HTTP Event Collector token with a name of your choice.
  • Ensure indexer acknowledgement is not enabled.
  • Click Next and set the source type to Automatic.
  • Add the main index
  • Set the Default Index to main.
  • Click Review and then Submit.
  • When complete the HEC token should look something like this:


After configuring both splunk_hec and the puppet_metrics_collector the Overview tab will start showing data from Puppet reports, while the Metrics tab will start displaying graphs related to a number of useful Puppet metrics.

Reports Overview


Advanced Configuration

All dashboard views support using custom indexes for storing event data. The searches assume each sourcetype can be stored in it's own index. There is one top level macro (puppet_index) which defaults to "".

As such, you can specify different HEC tokens for Summary Reports, Facts, and Metrics in splunk_hec. If you configure multiple HEC tokens to utilize different indexes, change the index value in the dashboards to reflect this.

Example Configuration:

Create five indexes named puppet_data, puppet_summary_data, puppet_facts_data, puppet_metrics_data, and puppet_detailed_data.

Create five HEC tokens:

  • puppet_data with sourcetype of automatic and the index puppet_data.
  • puppet_summary with sourcetype of puppet:summary and the index puppet_summary_data.
  • puppet_facts with sourcetype of puppet:facts and the index of puppet_facts_data.
  • puppet_metrics with sourcetype of puppet:metrics and the index of puppet_metrics_data.
  • puppet_detailed with sourcetype of puppet:detailed and the index of puppet_detailed_data.

Configure the splunk_hec module with the following token parameters:

  • splunk_hec::token with the puppet_data token value.
  • splunk_hec::token_summary with the puppet_summary token value.
  • splunk_hec::token_facts with the puppet_facts token value.
  • splunk_hec::token_metrics with the puppet_metrics token value.

Update the search macros to use the new values:

  • Open Advanced Search under Settings > Knowledge.
  • Select Search Macros.
  • Select puppet_index and change the definition to index=puppet_data, click save.
  • Select puppet_summary_index and change the definition to index=puppet_summary_data, click save.
  • Select puppet_facts_index and change the definition to index=puppet_facts_data, click save.
  • Select puppet_metrics_index and change the definition to index=puppet_metrics_data, click save.
  • Select puppet_detailed_index and change the definition to index=puppet_detailed_data, click save.

Upon reloading the Overview tab in the Puppet Report Viewer app, and you should begin seeing data. Alternatively, perform the following search:

`puppet_all_index` sourcetype=puppet:*

Troubleshooting and Verification

If the Puppet Report Viewer does not appear to show any data after you have followed the configuration steps for both this app and the splunk_hec module; first check that data is being successfully sent to the Splunk server by following the troubleshooting and verification steps in the splunk_hec documentation.

If events in the puppet:detailed source type are not showing up in search, it means that the "Generate a Detailed Report" Alert is not configured properly with the Puppet Alert Actions add-on. If this Alert is enabled, and the aforementioned add-on is configured, you can view the logs with the following Splunk search:

index=_internal sourcetype=splunkd component=sendmodalert (action="puppet_run_task_investigate" OR action="puppet_run_task" OR action="puppet_run_task_act" OR action="puppet_generate_detailed_report")

There is also a view into the Alert Actions logs under the Actions tab which will show these searches as well.

If there are no error messages, verify that the configured HEC works can be used to submit a report manually:

$ curl -k -H "Authorization: Splunk <yourHECtoken>" https://localhost:8088/services/collector/event -d '{"sourcetype": "puppet:detailed", "event": "exampletest"}'

The endpoint will respond with either a success or an error message. Follow steps in the HTTP Event Collector documentation to resolve issues with the HEC endpoint.

If there are other error messages in the logs related to PE RBAC tokens from the Puppet side, run the following command to query the PuppetDB API:

curl -k 'https://<your.puppetdb.server>:8081/pdb/query/v4/nodes' -H "X-Authentication: <token contents>"

Release Notes

Version 4.0.0
June 22, 2022

Breaking Changes:

New Features:

  • Changes to Metrics dropdowns for better filtering.
  • Changes to Metrics view to chart a number of metrics by host for comparison view.
  • New PE Metrics tab contains Metrics and Status Checks.


  • Removes conditional filtering for PostgreSQL metric dashboards preventing them from properly loading.
Version 3.1.2
Nov. 15, 2021

New Features:

  • New dashboard panels added to the metrics tab which track a number of useful metrics for PostgreSQL.


  • Reorganized the order of the navigation tabs in the app.
Version 3.1.1
Sept. 29, 2021

New Features:

  • puppet:activities_console, and puppet:activities_code_manager source types added.


  • In a distributed Splunk installation, it was previously required to have this add-on installed on both the Search Heads and the Indexers to ensure that the source types were available across the installation. Removing the AUTO_KV_JSON setting to allow for the default value (true); JSON parsing now occurs at search-time.
Version 3.1.0
Aug. 12, 2021

New Features:

  • This version replaces the default dashboards available in the Metrics tab with all new dashboards; measuring a number of useful metrics for Puppet Server, PuppetDB and Orchestrator.
Version 3.0.3
Jan. 20, 2021

New Features:
- puppet:jobs, puppet:activities_rbac, and puppet:activities_classifier sourcetypes added.

- Some of the panels in the Overview dashboard still contain the "X" button in the upper right to close the pop-up panel when you click on the primary panel. Some of the other panels lost the X.

  • Changed the drilldown to set/unset the token that shows the drilldown panel on click. Effect of the change is that clicking on the panel with the drilldown hidden shows the drilldown. Clicking on the panel with the drilldown showing hides the drilldown.

  • Also removed the remaining "X" buttons.

  • Standardize some visual formatting - moved "units" to "captions" on the images to "hosts, seconds, etc" shows up underneath the reported numbers, rather than next to them, removed odd height settings.

Version 3.0.2
Dec. 10, 2020

New Features:
- puppet:events_summary and puppet:activity sourcetypes added.

- The searches that are used in the Overview tab to display resources under the "# of Resources" element and associated table used to display the number of reports. They have been corrected to display the number of resources.

Version 3.0.1
March 19, 2020

This is a Viewer only release Puppet Report Viewer, it does not contain any custom alert actions and upgrading to this will require also installing the new Puppet Alert Actions App.

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.