From 61285e23515ee7356be15d03046ccffcec85bae7 Mon Sep 17 00:00:00 2001
From: Yves Siegrist <Elektron1c97@gmail.com>
Date: Sun, 19 Nov 2023 14:12:48 +0100
Subject: [PATCH 1/4] Fix linux-2.6 in download URL for RPMs

Starting with 9.0.5 Splunk changed the filename of the RPM. It no longer includes
"linux-2.6", thus we need to adapt to this change.
---
 manifests/params.pp             | 13 +++++--
 spec/classes/enterprise_spec.rb | 61 ++++++++++++++++++++++++++++++++-
 2 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/manifests/params.pp b/manifests/params.pp
index 12b7d063..7a3dff58 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -302,6 +302,13 @@
     default:   { $package_provider = undef } # Don't define a $package_provider
   }
 
+  # Download URLs changed starting from 8.2.11 and 9.0.5 for RPMs.
+  # Splunk no longer includes "-linux-2.6-".
+  $linux_prefix = (versioncmp($version, '9.0.5') >= 0 or (versioncmp($version, '8.2.11') >= 0 and versioncmp($version, '9.0.0') == -1)) ? {
+    true  => '.',
+    false => '-linux-2.6-',
+  }
+
   # Settings specific to an architecture as well as an OS family
   case "${facts['os']['family']} ${facts['os']['architecture']}" {
     'RedHat i386': {
@@ -310,12 +317,12 @@
       $enterprise_package_name = 'splunk'
     }
     'RedHat x86_64': {
-      $package_suffix          = "${version}-${build}-linux-2.6-x86_64.rpm"
+      $package_suffix          = "${version}-${build}${linux_prefix}x86_64.rpm"
       $forwarder_package_name  = 'splunkforwarder'
       $enterprise_package_name = 'splunk'
     }
     'RedHat ppc64le': {
-      $package_suffix          = "${version}-${build}-linux-2.6-ppc64le.rpm"
+      $package_suffix          = "${version}-${build}${linux_prefix}ppc64le.rpm"
       $forwarder_package_name  = 'splunkforwarder'
       $enterprise_package_name = 'splunk'
     }
@@ -350,7 +357,7 @@
       $enterprise_package_name = 'splunk'
     }
     'Suse x86_64': {
-      $package_suffix          = "${version}-${build}-linux-2.6-x86_64.rpm"
+      $package_suffix          = "${version}-${build}${linux_prefix}x86_64.rpm"
       $forwarder_package_name  = 'splunkforwarder'
       $enterprise_package_name = 'splunk'
     }
diff --git a/spec/classes/enterprise_spec.rb b/spec/classes/enterprise_spec.rb
index 7bd12ef2..3d513045 100644
--- a/spec/classes/enterprise_spec.rb
+++ b/spec/classes/enterprise_spec.rb
@@ -39,7 +39,66 @@
 end
 
 describe 'splunk::enterprise' do
-  context 'supported operating systems' do
+  context 'correct download URL' do
+    test_on = {
+      hardwaremodels: ['x86_64'],
+      supported_os: [
+        {
+          'operatingsystem'        => 'RedHat',
+          'operatingsystemrelease' => ['9'],
+        },
+      ],
+    }
+    on_supported_os(test_on).each do |os, facts|
+      context "on #{os}" do
+        let(:facts) { facts }
+
+        context 'when version is higher than 8.2.11' do
+          let(:pre_condition) do
+            "class { 'splunk::params': version => '8.2.12', build => 'build' }"
+          end
+
+          it {
+            is_expected.to compile.with_all_deps
+            is_expected.to contain_class('splunk::enterprise').with(enterprise_package_src: 'https://download.splunk.com/products/splunk/releases/8.2.12/linux/splunk-8.2.12-build.x86_64.rpm')
+          }
+        end
+
+        context 'when version is lower than 9.0.5' do
+          let(:pre_condition) do
+            "class { 'splunk::params': version => '9.0.0', build => 'build' }"
+          end
+
+          it {
+            is_expected.to compile.with_all_deps
+            is_expected.to contain_class('splunk::enterprise').with(enterprise_package_src: 'https://download.splunk.com/products/splunk/releases/9.0.0/linux/splunk-9.0.0-build-linux-2.6-x86_64.rpm')
+          }
+        end
+
+        context 'when version is 9.0.5' do
+          let(:pre_condition) do
+            "class { 'splunk::params': version => '9.0.5', build => 'build' }"
+          end
+
+          it {
+            is_expected.to compile.with_all_deps
+            is_expected.to contain_class('splunk::enterprise').with(enterprise_package_src: 'https://download.splunk.com/products/splunk/releases/9.0.5/linux/splunk-9.0.5-build.x86_64.rpm')
+          }
+        end
+
+        context 'when version is higher than 9.0.5' do
+          let(:pre_condition) do
+            "class { 'splunk::params': version => '9.1.0', build => 'build' }"
+          end
+
+          it {
+            is_expected.to compile.with_all_deps
+            is_expected.to contain_class('splunk::enterprise').with(enterprise_package_src: 'https://download.splunk.com/products/splunk/releases/9.1.0/linux/splunk-9.1.0-build.x86_64.rpm')
+          }
+        end
+      end
+    end
+
     on_supported_os.each do |os, facts|
       next if facts[:os]['name'] == 'windows' # Splunk Server not used supported on windows
 

From 76aa016eae170ef6e025f9b2000bde60a1b1b4ae Mon Sep 17 00:00:00 2001
From: Yves Siegrist <Elektron1c97@gmail.com>
Date: Sun, 17 Mar 2024 19:35:11 +0100
Subject: [PATCH 2/4] Stop requiring net-tools for Splunk 8.x and newer

Also make sure to not install net-tools for splunk enterprise on Solaris.

https://github.com/voxpupuli/puppet-splunk/pull/335
This was just added to the splunk forwarder, not for splunk enterprise.
---
 manifests/enterprise/install/nix.pp |   9 +-
 manifests/forwarder/install.pp      |   9 +-
 spec/classes/enterprise_spec.rb     | 680 ++++++++++++++--------------
 3 files changed, 354 insertions(+), 344 deletions(-)

diff --git a/manifests/enterprise/install/nix.pp b/manifests/enterprise/install/nix.pp
index 33b220ca..41ded0e6 100644
--- a/manifests/enterprise/install/nix.pp
+++ b/manifests/enterprise/install/nix.pp
@@ -30,8 +30,13 @@
     }
   }
 
-  # Required for splunk 7.2.4.2
-  if $splunk::params::manage_net_tools and versioncmp($splunk::enterprise::version, '7.2.4.2') >= 0 {
+  # Required for splunk from 7.2.4.2 until 8.0.0
+  if (
+    $splunk::params::manage_net_tools and
+    $facts['kernel'] == 'Linux' and
+    versioncmp($splunk::enterprise::version, '7.2.4.2') >= 0 and
+    versioncmp($splunk::enterprise::version, '8.0.0') == -1
+  ) {
     stdlib::ensure_packages(['net-tools'], {
         'ensure' => 'present',
     })
diff --git a/manifests/forwarder/install.pp b/manifests/forwarder/install.pp
index 4d64bda2..66a00855 100644
--- a/manifests/forwarder/install.pp
+++ b/manifests/forwarder/install.pp
@@ -61,8 +61,13 @@
     }
   }
 
-  # Required for splunk 7.2.4.2
-  if $splunk::params::manage_net_tools and $facts['kernel'] == 'Linux' and (versioncmp($splunk::forwarder::version, '7.2.4.2') >= 0) {
+  # Required for splunk from 7.2.4.2 until 8.0.0
+  if (
+    $splunk::params::manage_net_tools and
+    $facts['kernel'] == 'Linux' and
+    versioncmp($splunk::forwarder::version, '7.2.4.2') >= 0 and
+    versioncmp($splunk::forwarder::version, '8.0.0') == -1
+  ) {
     stdlib::ensure_packages(['net-tools'], {
         'ensure' => 'present',
     })
diff --git a/spec/classes/enterprise_spec.rb b/spec/classes/enterprise_spec.rb
index 3d513045..2c8f1d8b 100644
--- a/spec/classes/enterprise_spec.rb
+++ b/spec/classes/enterprise_spec.rb
@@ -98,367 +98,367 @@
         end
       end
     end
+  end
 
-    on_supported_os.each do |os, facts|
-      next if facts[:os]['name'] == 'windows' # Splunk Server not used supported on windows
+  on_supported_os.each do |os, facts|
+    next if facts[:os]['name'] == 'windows' # Splunk Server not used supported on windows
 
-      context "on #{os}" do
-        let(:facts) do
-          facts
+    context "on #{os}" do
+      let(:facts) do
+        facts
+      end
+
+      context 'splunk when including forwarder and enterprise' do
+        let(:pre_condition) do
+          'include splunk::forwarder'
         end
 
-        context 'splunk when including forwarder and enterprise' do
-          let(:pre_condition) do
-            'include splunk::forwarder'
-          end
+        it { is_expected.to compile.and_raise_error(%r{Do not include splunk::forwarder on the same node as splunk::enterprise}) }
+      end
+
+      context 'when manage_password = true' do
+        if facts[:kernel] == 'Linux' || facts[:kernel] == 'SunOS'
+          let(:params) { { 'manage_password' => true } }
 
-          it { is_expected.to compile.and_raise_error(%r{Do not include splunk::forwarder on the same node as splunk::enterprise}) }
+          it { is_expected.to compile.with_all_deps }
+          it { is_expected.to contain_file('/opt/splunk/etc/splunk.secret') }
+          it { is_expected.to contain_file('/opt/splunk/etc/passwd') }
         end
+      end
 
-        context 'when manage_password = true' do
-          if facts[:kernel] == 'Linux' || facts[:kernel] == 'SunOS'
-            let(:params) { { 'manage_password' => true } }
+      context 'when package_provider = yum' do
+        if facts[:kernel] == 'Linux' || facts[:kernel] == 'SunOS'
+          let(:params) { { 'package_provider' => 'yum' } }
 
-            it { is_expected.to compile.with_all_deps }
-            it { is_expected.to contain_file('/opt/splunk/etc/splunk.secret') }
-            it { is_expected.to contain_file('/opt/splunk/etc/passwd') }
-          end
+          it { is_expected.to contain_package('splunk').with(provider: 'yum') }
         end
+      end
 
-        context 'when package_provider = yum' do
-          if facts[:kernel] == 'Linux' || facts[:kernel] == 'SunOS'
-            let(:params) { { 'package_provider' => 'yum' } }
+      context 'with $boot_start = true (defaults)' do
+        if facts[:kernel] == 'Linux' || facts[:kernel] == 'SunOS'
 
-            it { is_expected.to contain_package('splunk').with(provider: 'yum') }
+          context 'with $facts[service_provider] == init and $splunk::params::version >= 7.2.2' do
+            let(:facts) do
+              facts.merge(service_provider: 'init')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '7.2.4.2' }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.to contain_package('net-tools').with(ensure: 'installed') } if facts[:kernel] == 'Linux'
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
+            it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
+            it { is_expected.not_to contain_exec('disable_splunk') }
+            it { is_expected.not_to contain_exec('license_splunk') }
+            it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
           end
-        end
 
-        context 'with $boot_start = true (defaults)' do
-          if facts[:kernel] == 'Linux' || facts[:kernel] == 'SunOS'
-
-            context 'with $facts[service_provider] == init and $splunk::params::version >= 7.2.2' do
-              let(:facts) do
-                facts.merge(service_provider: 'init')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '7.2.4.2' }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.to contain_package('net-tools').with(ensure: 'installed') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
-              it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
-              it { is_expected.not_to contain_exec('disable_splunk') }
-              it { is_expected.not_to contain_exec('license_splunk') }
-              it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
-            end
-
-            context 'with $facts[service_provider] == init and $splunk::params::version >= 7.2.2 and manage_net_tools == false' do
-              let(:facts) do
-                facts.merge(service_provider: 'init')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '7.2.4.2', manage_net_tools => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
-              it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
-              it { is_expected.not_to contain_exec('disable_splunk') }
-              it { is_expected.not_to contain_exec('license_splunk') }
-              it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
-            end
-
-            context 'with $facts[service_provider] == init and $splunk::params::version < 7.2.2' do
-              let(:facts) do
-                facts.merge(service_provider: 'init')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '6.0.0' }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools').with(ensure: 'installed') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
-              it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
-              it { is_expected.not_to contain_exec('disable_splunk') }
-              it { is_expected.not_to contain_exec('license_splunk') }
-              it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
-            end
-
-            context 'with $facts[service_provider] == init and $splunk::params::version < 7.2.2 and manage_net_tools == false' do
-              let(:facts) do
-                facts.merge(service_provider: 'init')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '6.0.0', manage_net_tools => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
-              it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
-              it { is_expected.not_to contain_exec('disable_splunk') }
-              it { is_expected.not_to contain_exec('license_splunk') }
-              it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
-            end
-
-            context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2' do
-              let(:facts) do
-                facts.merge(service_provider: 'systemd')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '7.2.4.2' }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.to contain_package('net-tools').with(ensure: 'installed') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'Splunkd') }
-              it { is_expected.to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
-              it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start  -systemd-managed 1 --accept-license --answer-yes --no-prompt') }
-              it { is_expected.not_to contain_exec('disable_splunk') }
-              it { is_expected.not_to contain_exec('license_splunk') }
-              it { is_expected.to contain_service('Splunkd').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
-            end
-
-            context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2 and manage_net_tools == false' do
-              let(:facts) do
-                facts.merge(service_provider: 'systemd')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '7.2.4.2', manage_net_tools => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'Splunkd') }
-              it { is_expected.to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
-              it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start  -systemd-managed 1 --accept-license --answer-yes --no-prompt') }
-              it { is_expected.not_to contain_exec('disable_splunk') }
-              it { is_expected.not_to contain_exec('license_splunk') }
-              it { is_expected.to contain_service('Splunkd').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
-            end
-
-            context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2 and user != root' do
-              let(:facts) do
-                facts.merge(service_provider: 'systemd')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '7.2.4.2' }"
-              end
-              let(:params) { { splunk_user: 'splunk' } }
-
-              it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 1 --accept-license --answer-yes --no-prompt') }
-            end
-
-            context 'with $facts[service_provider] == systemd and $splunk::params::version < 7.2.2' do
-              let(:facts) do
-                facts.merge(service_provider: 'systemd')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '6.0.0' }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools').with(ensure: 'installed') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
-              it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
-              it { is_expected.not_to contain_exec('disable_splunk') }
-              it { is_expected.not_to contain_exec('license_splunk') }
-              it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
-            end
-
-            context 'with $facts[service_provider] == systemd and $splunk::params::version < 7.2.2 and manage_net_tools == false' do
-              let(:facts) do
-                facts.merge(service_provider: 'systemd')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '6.0.0', manage_net_tools => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
-              it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
-              it { is_expected.not_to contain_exec('disable_splunk') }
-              it { is_expected.not_to contain_exec('license_splunk') }
-              it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
+          context 'with $facts[service_provider] == init and $splunk::params::version >= 7.2.2 and manage_net_tools == false' do
+            let(:facts) do
+              facts.merge(service_provider: 'init')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '7.2.4.2', manage_net_tools => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
+            it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
+            it { is_expected.not_to contain_exec('disable_splunk') }
+            it { is_expected.not_to contain_exec('license_splunk') }
+            it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
+          end
+
+          context 'with $facts[service_provider] == init and $splunk::params::version < 7.2.2' do
+            let(:facts) do
+              facts.merge(service_provider: 'init')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '6.0.0' }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools').with(ensure: 'installed') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
+            it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
+            it { is_expected.not_to contain_exec('disable_splunk') }
+            it { is_expected.not_to contain_exec('license_splunk') }
+            it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
+          end
+
+          context 'with $facts[service_provider] == init and $splunk::params::version < 7.2.2 and manage_net_tools == false' do
+            let(:facts) do
+              facts.merge(service_provider: 'init')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '6.0.0', manage_net_tools => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
+            it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
+            it { is_expected.not_to contain_exec('disable_splunk') }
+            it { is_expected.not_to contain_exec('license_splunk') }
+            it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
+          end
+
+          context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2' do
+            let(:facts) do
+              facts.merge(service_provider: 'systemd')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '7.2.4.2' }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.to contain_package('net-tools').with(ensure: 'installed') } if facts[:kernel] == 'Linux'
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'Splunkd') }
+            it { is_expected.to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
+            it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start  -systemd-managed 1 --accept-license --answer-yes --no-prompt') }
+            it { is_expected.not_to contain_exec('disable_splunk') }
+            it { is_expected.not_to contain_exec('license_splunk') }
+            it { is_expected.to contain_service('Splunkd').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
+          end
+
+          context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2 and manage_net_tools == false' do
+            let(:facts) do
+              facts.merge(service_provider: 'systemd')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '7.2.4.2', manage_net_tools => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'Splunkd') }
+            it { is_expected.to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
+            it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start  -systemd-managed 1 --accept-license --answer-yes --no-prompt') }
+            it { is_expected.not_to contain_exec('disable_splunk') }
+            it { is_expected.not_to contain_exec('license_splunk') }
+            it { is_expected.to contain_service('Splunkd').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
+          end
+
+          context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2 and user != root' do
+            let(:facts) do
+              facts.merge(service_provider: 'systemd')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '7.2.4.2' }"
+            end
+            let(:params) { { splunk_user: 'splunk' } }
+
+            it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 1 --accept-license --answer-yes --no-prompt') }
+          end
+
+          context 'with $facts[service_provider] == systemd and $splunk::params::version < 7.2.2' do
+            let(:facts) do
+              facts.merge(service_provider: 'systemd')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '6.0.0' }"
             end
 
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools').with(ensure: 'installed') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
+            it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
+            it { is_expected.not_to contain_exec('disable_splunk') }
+            it { is_expected.not_to contain_exec('license_splunk') }
+            it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
           end
+
+          context 'with $facts[service_provider] == systemd and $splunk::params::version < 7.2.2 and manage_net_tools == false' do
+            let(:facts) do
+              facts.merge(service_provider: 'systemd')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '6.0.0', manage_net_tools => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.to contain_exec('stop_splunk').with(command: '/opt/splunk/bin/splunk stop') }
+            it { is_expected.to contain_exec('enable_splunk').with(command: '/opt/splunk/bin/splunk enable boot-start -user root  --accept-license --answer-yes --no-prompt') }
+            it { is_expected.not_to contain_exec('disable_splunk') }
+            it { is_expected.not_to contain_exec('license_splunk') }
+            it { is_expected.to contain_service('splunk').with(ensure: 'running', enable: true, status: nil, restart: nil, start: nil, stop: nil) }
+          end
+
         end
+      end
+
+      context 'with $boot_start = false' do
+        if facts[:kernel] == 'Linux' || facts[:kernel] == 'SunOS'
 
-        context 'with $boot_start = false' do
-          if facts[:kernel] == 'Linux' || facts[:kernel] == 'SunOS'
-
-            context 'with $facts[service_provider] == init and $splunk::params::version >= 7.2.2' do
-              let(:facts) do
-                facts.merge(service_provider: 'init')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '7.2.4.2', boot_start => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.to contain_package('net-tools').with(ensure: 'installed') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.not_to contain_exec('stop_splunk') }
-              it { is_expected.not_to contain_exec('enable_splunk') }
-              it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
-            end
-
-            context 'with $facts[service_provider] == init and $splunk::params::version >= 7.2.2 and manage_net_tools == false' do
-              let(:facts) do
-                facts.merge(service_provider: 'init')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '7.2.4.2', boot_start => false, manage_net_tools => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.not_to contain_exec('stop_splunk') }
-              it { is_expected.not_to contain_exec('enable_splunk') }
-              it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
-            end
-
-            context 'with $facts[service_provider] == init and $splunk::params::version < 7.2.2' do
-              let(:facts) do
-                facts.merge(service_provider: 'init')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '6.0.0', boot_start => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools').with(ensure: 'installed') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.not_to contain_exec('stop_splunk') }
-              it { is_expected.not_to contain_exec('enable_splunk') }
-              it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
-            end
-
-            context 'with $facts[service_provider] == init and $splunk::params::version < 7.2.2 and manage_net_tools == false' do
-              let(:facts) do
-                facts.merge(service_provider: 'init')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '6.0.0', boot_start => false, manage_net_tools => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.not_to contain_exec('stop_splunk') }
-              it { is_expected.not_to contain_exec('enable_splunk') }
-              it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
-            end
-
-            context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2' do
-              let(:facts) do
-                facts.merge(service_provider: 'systemd')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '7.2.4.2', boot_start => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.to contain_package('net-tools').with(ensure: 'installed') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'Splunkd') }
-              it { is_expected.to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.not_to contain_exec('stop_splunk') }
-              it { is_expected.not_to contain_exec('enable_splunk') }
-              it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_service('Splunkd').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
-            end
-
-            context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2 and manage_net_tools == false' do
-              let(:facts) do
-                facts.merge(service_provider: 'systemd')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '7.2.4.2', boot_start => false, manage_net_tools => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'Splunkd') }
-              it { is_expected.to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.not_to contain_exec('stop_splunk') }
-              it { is_expected.not_to contain_exec('enable_splunk') }
-              it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_service('Splunkd').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
-            end
-
-            context 'with $facts[service_provider] == systemd and $splunk::params::version < 7.2.2' do
-              let(:facts) do
-                facts.merge(service_provider: 'systemd')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '6.0.0', boot_start => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools').with(ensure: 'installed') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.not_to contain_exec('stop_splunk') }
-              it { is_expected.not_to contain_exec('enable_splunk') }
-              it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
-            end
-
-            context 'with $facts[service_provider] == systemd and $splunk::params::version < 7.2.2 and manage_net_tools == false' do
-              let(:facts) do
-                facts.merge(service_provider: 'systemd')
-              end
-              let(:pre_condition) do
-                "class { 'splunk::params': version => '6.0.0', boot_start => false, manage_net_tools => false }"
-              end
-
-              it_behaves_like 'splunk enterprise nix defaults'
-              it { is_expected.not_to contain_package('net-tools') }
-              it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
-              it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
-              it { is_expected.not_to contain_exec('stop_splunk') }
-              it { is_expected.not_to contain_exec('enable_splunk') }
-              it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
-              it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
+          context 'with $facts[service_provider] == init and $splunk::params::version >= 7.2.2' do
+            let(:facts) do
+              facts.merge(service_provider: 'init')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '7.2.4.2', boot_start => false }"
             end
 
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.to contain_package('net-tools').with(ensure: 'installed') } if facts[:kernel] == 'Linux'
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.not_to contain_exec('stop_splunk') }
+            it { is_expected.not_to contain_exec('enable_splunk') }
+            it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
           end
+
+          context 'with $facts[service_provider] == init and $splunk::params::version >= 7.2.2 and manage_net_tools == false' do
+            let(:facts) do
+              facts.merge(service_provider: 'init')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '7.2.4.2', boot_start => false, manage_net_tools => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.not_to contain_exec('stop_splunk') }
+            it { is_expected.not_to contain_exec('enable_splunk') }
+            it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
+          end
+
+          context 'with $facts[service_provider] == init and $splunk::params::version < 7.2.2' do
+            let(:facts) do
+              facts.merge(service_provider: 'init')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '6.0.0', boot_start => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools').with(ensure: 'installed') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.not_to contain_exec('stop_splunk') }
+            it { is_expected.not_to contain_exec('enable_splunk') }
+            it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
+          end
+
+          context 'with $facts[service_provider] == init and $splunk::params::version < 7.2.2 and manage_net_tools == false' do
+            let(:facts) do
+              facts.merge(service_provider: 'init')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '6.0.0', boot_start => false, manage_net_tools => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.not_to contain_exec('stop_splunk') }
+            it { is_expected.not_to contain_exec('enable_splunk') }
+            it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
+          end
+
+          context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2' do
+            let(:facts) do
+              facts.merge(service_provider: 'systemd')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '7.2.4.2', boot_start => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.to contain_package('net-tools').with(ensure: 'installed') } if facts[:kernel] == 'Linux'
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'Splunkd') }
+            it { is_expected.to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.not_to contain_exec('stop_splunk') }
+            it { is_expected.not_to contain_exec('enable_splunk') }
+            it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_service('Splunkd').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
+          end
+
+          context 'with $facts[service_provider] == systemd and $splunk::params::version >= 7.2.2 and manage_net_tools == false' do
+            let(:facts) do
+              facts.merge(service_provider: 'systemd')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '7.2.4.2', boot_start => false, manage_net_tools => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'Splunkd') }
+            it { is_expected.to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.not_to contain_exec('stop_splunk') }
+            it { is_expected.not_to contain_exec('enable_splunk') }
+            it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_service('Splunkd').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
+          end
+
+          context 'with $facts[service_provider] == systemd and $splunk::params::version < 7.2.2' do
+            let(:facts) do
+              facts.merge(service_provider: 'systemd')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '6.0.0', boot_start => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools').with(ensure: 'installed') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.not_to contain_exec('stop_splunk') }
+            it { is_expected.not_to contain_exec('enable_splunk') }
+            it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
+          end
+
+          context 'with $facts[service_provider] == systemd and $splunk::params::version < 7.2.2 and manage_net_tools == false' do
+            let(:facts) do
+              facts.merge(service_provider: 'systemd')
+            end
+            let(:pre_condition) do
+              "class { 'splunk::params': version => '6.0.0', boot_start => false, manage_net_tools => false }"
+            end
+
+            it_behaves_like 'splunk enterprise nix defaults'
+            it { is_expected.not_to contain_package('net-tools') }
+            it { is_expected.to contain_class('splunk::enterprise').with(service_name: 'splunk') }
+            it { is_expected.not_to contain_file('/etc/init.d/splunk').with(ensure: 'absent') }
+            it { is_expected.not_to contain_exec('stop_splunk') }
+            it { is_expected.not_to contain_exec('enable_splunk') }
+            it { is_expected.to contain_exec('disable_splunk').with(command: '/opt/splunk/bin/splunk disable boot-start -user root --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_exec('license_splunk').with(command: '/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt') }
+            it { is_expected.to contain_service('splunk').with(restart: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk restart'", start: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk start'", stop: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk stop'", status: "/usr/sbin/runuser -l root -c '/opt/splunk/bin/splunk status'") }
+          end
+
         end
       end
     end

From 9f28799316164e343c999533de7fe0b0bc3536b6 Mon Sep 17 00:00:00 2001
From: Yves Siegrist <Elektron1c97@gmail.com>
Date: Sun, 17 Mar 2024 19:06:15 +0100
Subject: [PATCH 3/4] Adjust for latest 9.2.0.1 version

A fresh install of the module should probably install a current version of
Splunk, not an already EOL version like 7.2.4.2 before.

Fix user handling:
  Splunk Enterprise uses "splunk". https://docs.splunk.com/Documentation/Splunk/latest/Installation/RunSplunkasadifferentornon-rootuser
  Splunk Forwarder used "splunk" until 9.1.0, then they changed it to "splunkfwd", see https://community.splunk.com/t5/Splunk-Enterprise/Why-did-Universal-forwarder-9-1-0-linux-change-owner/m-p/655673
---
 REFERENCE.md                              | 14 ++++++++++----
 manifests/forwarder.pp                    |  5 ++++-
 manifests/params.pp                       |  6 +++---
 spec/acceptance/splunk_enterprise_spec.rb |  4 ++--
 4 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/REFERENCE.md b/REFERENCE.md
index 9e8ede28..61f3db43 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -994,7 +994,13 @@ Data type: `String[1]`
 
 The user to run Splunk as.
 
-Default value: `$splunk::params::splunk_user`
+Default value:
+
+```puppet
+versioncmp($version, '9.1.0') ? {
+    -1 => $splunk::params::splunk_user,
+    default => 'splunkfwd'
+```
 
 ##### <a name="-splunk--forwarder--forwarder_homedir"></a>`forwarder_homedir`
 
@@ -1495,7 +1501,7 @@ Data type: `String[1]`
 The version of Splunk to install. This will be in the form x.y.z; e.g.
 "4.3.2".
 
-Default value: `'7.2.4.2'`
+Default value: `'9.2.0.1'`
 
 ##### <a name="-splunk--params--build"></a>`build`
 
@@ -1507,7 +1513,7 @@ automatically but a build number must be supplied in order to correctly
 construct the path to the packages. A build number will be six digits;
 e.g. "123586".
 
-Default value: `'fb30470262e3'`
+Default value: `'d8ae995bf219'`
 
 ##### <a name="-splunk--params--splunkd_port"></a>`splunkd_port`
 
@@ -1545,7 +1551,7 @@ Default value:
 ```puppet
 $facts['os']['family'] ? {
     'windows' => 'Administrator',
-    default => 'root'
+    default => versioncmp($version, '8.0.0') ? { -1 => 'root', default => 'splunk'
 ```
 
 ##### <a name="-splunk--params--src_root"></a>`src_root`
diff --git a/manifests/forwarder.pp b/manifests/forwarder.pp
index 93b36f60..d9ca0876 100644
--- a/manifests/forwarder.pp
+++ b/manifests/forwarder.pp
@@ -165,7 +165,10 @@
   Boolean $manage_package_source             = true,
   Optional[String[1]] $package_source        = undef,
   Splunk::Fwdinstalloptions $install_options = $splunk::params::forwarder_install_options,
-  String[1] $splunk_user                     = $splunk::params::splunk_user,
+  String[1] $splunk_user                     = versioncmp($version, '9.1.0') ? {
+    -1 => $splunk::params::splunk_user,
+    default => 'splunkfwd',
+  },
   Stdlib::Absolutepath $forwarder_homedir    = $splunk::params::forwarder_homedir,
   Stdlib::Absolutepath $forwarder_confdir    = $splunk::params::forwarder_confdir,
   String[1] $service_name                    = $splunk::params::forwarder_service,
diff --git a/manifests/params.pp b/manifests/params.pp
index 7a3dff58..835cc7d0 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -101,8 +101,8 @@
 #   Disable certificate verification when connecting to SSL hosts to download packages.
 #
 class splunk::params (
-  String[1] $version                         = '7.2.4.2',
-  String[1] $build                           = 'fb30470262e3',
+  String[1] $version                         = '9.2.0.1',
+  String[1] $build                           = 'd8ae995bf219',
   String[1] $src_root                        = 'https://download.splunk.com',
   Stdlib::Port $splunkd_port                 = 8089,
   Stdlib::Port $logging_port                 = 9997,
@@ -112,7 +112,7 @@
   Boolean $boot_start                        = true,
   String[1] $splunk_user                     = $facts['os']['family'] ? {
     'windows' => 'Administrator',
-    default => 'root'
+    default => versioncmp($version, '8.0.0') ? { -1 => 'root', default => 'splunk' },
   },
   String[1] $default_host                    = $facts['clientcert'],
   Boolean $manage_net_tools                  = true,
diff --git a/spec/acceptance/splunk_enterprise_spec.rb b/spec/acceptance/splunk_enterprise_spec.rb
index c59baa01..69713f8d 100644
--- a/spec/acceptance/splunk_enterprise_spec.rb
+++ b/spec/acceptance/splunk_enterprise_spec.rb
@@ -46,8 +46,8 @@ class { 'splunk::enterprise': }
       describe file(conf_file_path) do
         it { is_expected.to be_file }
         it { is_expected.to be_mode 600 }
-        it { is_expected.to be_owned_by 'root' }
-        it { is_expected.to be_grouped_into 'root' }
+        it { is_expected.to be_owned_by 'splunk' }
+        it { is_expected.to be_grouped_into 'splunk' }
       end
     end
 

From 3ddde7a60ae1fb820ec2ea7b745e35ed27395677 Mon Sep 17 00:00:00 2001
From: Yves Siegrist <Elektron1c97@gmail.com>
Date: Sun, 17 Mar 2024 21:37:38 +0100
Subject: [PATCH 4/4] Test against older versions of Splunk

Also include basic testing for old versions:
- 7.4.2.4 (EOL)
- 8.2.9 (EOL)
- 9.0.0
---
 spec/acceptance/splunk_enterprise_spec.rb | 48 ++++++++++++++++++++-
 spec/acceptance/splunk_forwarder_spec.rb  | 51 +++++++++++++++++++----
 spec/spec_helper_acceptance.rb            |  5 +++
 3 files changed, 96 insertions(+), 8 deletions(-)

diff --git a/spec/acceptance/splunk_enterprise_spec.rb b/spec/acceptance/splunk_enterprise_spec.rb
index 69713f8d..be0cbfa6 100644
--- a/spec/acceptance/splunk_enterprise_spec.rb
+++ b/spec/acceptance/splunk_enterprise_spec.rb
@@ -10,6 +10,51 @@
                    'splunk'
                  end
 
+  OLD_SPLUNK_VERSIONS.each do |version, build|
+    context "Splunk version #{version}" do
+      after(:all) do
+        pp = <<-EOS
+        service { '#{service_name}': ensure => stopped }
+        package { 'splunk': ensure => purged }
+        file { '/opt/splunk': ensure => absent, force => true, require => Package['splunk'] }
+        file { '/etc/init.d/splunk': ensure => absent, require => Package['splunk'] }
+        file { '/etc/systemd/system/Splunkd.service': ensure => absent, require => Package['splunk'] }
+        EOS
+        apply_manifest(pp, catch_failures: true)
+      end
+
+      it 'works idempotently with no errors' do
+        pp = <<-EOS
+        class { 'splunk::params': version => '#{version}', build => '#{build}' }
+        class { 'splunk::enterprise': }
+
+        # See https://community.splunk.com/t5/Installation/Why-am-I-getting-an-error-to-start-a-fresh-Splunk-instance-in-my/m-p/336938
+        file_line { 'file_locking':
+          path => '/opt/splunk/etc/splunk-launch.conf',
+          line => 'OPTIMISTIC_ABOUT_FILE_LOCKING=1',
+          before => Exec['enable_splunk'],
+          require => Package['splunk'],
+        }
+        EOS
+
+        # Run it twice and test for idempotency
+        apply_manifest(pp, catch_failures: true)
+        apply_manifest(pp, catch_changes: true)
+        # give splunk some time to start
+        sleep(10)
+      end
+
+      describe package('splunk') do
+        it { is_expected.to be_installed }
+      end
+
+      describe service(service_name) do
+        it { is_expected.to be_enabled }
+        it { is_expected.to be_running }
+      end
+    end
+  end
+
   context 'default parameters' do
     # Using puppet_apply as a helper
     it 'works idempotently with no errors' do
@@ -20,7 +65,8 @@ class { 'splunk::enterprise': }
       file_line { 'file_locking':
         path => '/opt/splunk/etc/splunk-launch.conf',
         line => 'OPTIMISTIC_ABOUT_FILE_LOCKING=1',
-        require => Class['splunk::enterprise'],
+        before => Exec['enable_splunk'],
+        require => Package['splunk'],
       }
       EOS
 
diff --git a/spec/acceptance/splunk_forwarder_spec.rb b/spec/acceptance/splunk_forwarder_spec.rb
index feff4e47..6a539b46 100644
--- a/spec/acceptance/splunk_forwarder_spec.rb
+++ b/spec/acceptance/splunk_forwarder_spec.rb
@@ -3,6 +3,50 @@
 require 'spec_helper_acceptance'
 
 describe 'splunk::forwarder class' do
+  init = shell('/bin/readlink /sbin/init', acceptable_exit_codes: [0, 1]).stdout
+  service_name = if init.include? 'systemd'
+                   'SplunkForwarder'
+                 else
+                   'splunk'
+                 end
+
+  OLD_SPLUNK_VERSIONS.each do |version, build|
+    context "Splunk forwarder version #{version}" do
+      after(:all) do
+        pp = <<-EOS
+        service { '#{service_name}': ensure => stopped }
+        package { 'splunkforwarder': ensure => purged }
+        file { '/opt/splunkforwarder': ensure => absent, force => true, require => Package['splunkforwarder'] }
+        file { '/opt/splunk': ensure => absent, force => true, require => Package['splunkforwarder'] }
+        file { '/etc/systemd/system/SplunkForwarder.service': ensure => absent, require => Package['splunkforwarder'] }
+        EOS
+        apply_manifest(pp, catch_failures: true)
+      end
+
+      it 'works idempotently with no errors' do
+        pp = <<-EOS
+        class { 'splunk::params': version => '#{version}', build => '#{build}' }
+        class { 'splunk::forwarder':
+          splunkd_port => 8090,
+        }
+        EOS
+
+        # Run it twice and test for idempotency
+        apply_manifest(pp, catch_failures: true)
+        apply_manifest(pp, catch_changes: true)
+      end
+
+      describe package('splunkforwarder') do
+        it { is_expected.to be_installed }
+      end
+
+      describe service(service_name) do
+        it { is_expected.to be_enabled }
+        it { is_expected.to be_running }
+      end
+    end
+  end
+
   context 'default parameters' do
     # Using puppet_apply as a helper
     it 'works idempotently with no errors' do
@@ -32,13 +76,6 @@ class { 'splunk::forwarder':
       it { is_expected.to be_installed }
     end
 
-    init = shell('/bin/readlink /sbin/init', acceptable_exit_codes: [0, 1]).stdout
-    service_name = if init.include? 'systemd'
-                     'SplunkForwarder'
-                   else
-                     'splunk'
-                   end
-
     describe service(service_name) do
       it { is_expected.to be_enabled }
       it { is_expected.to be_running }
diff --git a/spec/spec_helper_acceptance.rb b/spec/spec_helper_acceptance.rb
index 707feaae..a2efa3aa 100644
--- a/spec/spec_helper_acceptance.rb
+++ b/spec/spec_helper_acceptance.rb
@@ -3,6 +3,11 @@
 require 'voxpupuli/acceptance/spec_helper_acceptance'
 require 'splunk_data'
 
+OLD_SPLUNK_VERSIONS = [
+  ['7.2.4.2', 'fb30470262e3'],
+  ['9.0.0', '6818ac46f2ec'],
+].freeze
+
 configure_beaker do |host|
   # Need to stage the Splunk/Splunkforwarder packages here.