Updated Splunk Quick Start

.metadata

@@ -0,0 +1 @@
+language_type: cloudformation

.taskcat.yml

@@ -3,36 +3,38 @@ project:
   owner: [email protected]
   package_lambda: false
   regions:
-  - ap-northeast-1
-  - ap-northeast-2
-  - ap-south-1
-  - ap-southeast-1
-  - ap-southeast-2
-  - ca-central-1
-  - eu-central-1
-  - eu-west-1
-  - eu-west-2
-  - sa-east-1
-  - us-east-1
-  - us-east-2
-  - us-west-1
   - us-west-2
   s3_bucket: ''
 tests:
   splunk-enterprise:
     parameters:
       AvailabilityZones: $[taskcat_genaz_2]
-      HECClientLocation: 10.0.0.0/16
-      KeyName: taskcat-test
+      KeyName: [your-aws-key]
       QSS3BucketName: $[taskcat_autobucket]
+      QSS3KeyPrefix: quickstart-splunk-enterprise/
       QSS3BucketRegion: $[taskcat_current_region]
-      SSHClientLocation: 10.0.0.0/16
-      SplunkAdminPassword: $[taskcat_genpass_10]
-      SplunkClusterSecret: $[taskcat_genpass_10]
-      SplunkIndexerDiscoverySecret: $[taskcat_genpass_10]
-      WebClientLocation: 72.21.196.66/32
-    regions:
-    - us-west-1
-    - us-east-2
+      SplunkAdminPassword: $[taskcat_genpass_8S]
+      SplunkClusterSecret: $[taskcat_genpass_8S]
+      SplunkIndexerDiscoverySecret: $[taskcat_genpass_8S]
+      IndexerInstanceType: i3.4xlarge
+      SearchHeadInstanceType: c5.4xlarge
+      SplunkIndexerDiskSize: '300'
+      SplunkSearchHeadDiskSize: '300'
+      SHCEnabled: 'no'
+      SplunkIndexerCount: 4
+      SplunkReplicationFactor: 2
+      SplunkSearchFactor: 2
+      SplunkLicenseBucket: [splunk-license-bucket-name]
+      SplunkLicensePath: [splunk-license-file]
+      WebClientLocation: 1.2.3.4/32
+      HECClientLocation: 1.2.3.4/32
+      SSHClientLocation: 1.2.3.4/32
+      VPCCIDR: 10.0.0.0/16
+      PublicSubnet1CIDR: 10.0.1.0/24
+      PublicSubnet2CIDR: 10.0.2.0/24
+      PublicSubnet3CIDR: 10.0.3.0/24
+      NumberOfAZs: 2
+      SmartStoreBucketName: $[taskcat_autobucket]
+    regions: $[taskcat_current_region]
     s3_bucket: ''
-    template: templates/splunk-enterprise-master.template.yaml
+    template: templates/splunk-enterprise-main.template.yaml

README.md

@@ -12,7 +12,7 @@ View the accompanying [deployment guide](https://fwd.aws/bGBmy) for everything y
 
 ### Prerequisites
 
-Before getting started with the template configuration, you will need to make your Splunk Enterprise license privately accessible for CloudFormation template deployment via S3 download.  The following steps will guide you through that process.   *(Note:  This step is not required, and you can upload your license from the Splunk web interface.  It is, however, required that you have a non-trial Splunk Enterprise license to fully utilize the deployment our template creates.  If you don't already have a Splunk Enterprise license, you can obtain one by contacting [email protected].)*
+Before getting started with the template configuration, you will need to make your Splunk Enterprise license privately accessible for CloudFormation template deployment via S3 download.  The following steps will guide you through that process.   *(Note:  This step is required.  A non-trial Splunk Enterprise license is required to allow our template to configure the Splunk deployment.  If you don't already have a Splunk Enterprise license, you can obtain one by contacting [email protected].)*
 
  1. From the AWS Console, select "S3" under the "Storage" heading, or by simply typing "S3" into the search bar.
  2. You can either select an existing private bucket to upload to, or create a new one. If you select an existing bucket, make sure its access policy does not grant public access. By default, all the S3 resources are private, so only the AWS account that created the resources can access them. For this exercise, I'm outlining how to create a new bucket.