fact gathering throws error if fact isn't present

[tboddyspargo]

input_mdoule_puppet_enterprise_factor.py throws an exception if a fact isn't returned by the HTTP(S) request. A value (even for a built-in fact) can be absent for legitimate reasons. In my environment, for example, many of our servers disable IPv6, so the ipaddress6 fact is not present. The resulting behavior is that the splunk add-on only collects facts for the nodes that have all the facts which are hard-coded in input_module_puppet_enterprise_factor.py. As soon as a node is encountered for which one of those facts is absent, an exception is thrown (KeyError) and no more are processed.

I think there 2 good solutions to this:

1. If it's not necessary to hard code the key names, you should be able to populate the dictionary dynamically based on the key names that are in the the JSON.

   Note: If you don't need to hard code the key names, but you do need to ensure that the resulting dictionaries all have consistent keys, then you could simply collect all unique key_names in an array while looping over the JSON and then massage the resulting dictionaries so that they all contain the same keys, even if some of those keys will not have a value. This strategy, while not optimal from a performance perspective, does ensure that custom facts are also available in the Splunk fact reports (I think).

2. If it's necessary to hard code the key names, define them in an array somewhere. Then, in the dictionary 'merging' section, you can loop over that array, catching the KeyError exceptions to avoid exiting prematurely.

[TraGicCode]

I'm running into this same issue in which we have disabled ipv6 via powershell dsc. Is this something this is being worked on?

[mrzarquon]

We've moved from a pull method in this Addon to pushing information such as Facts from the Puppet server itself. This also lets you customize which facts you want to collect, and by default doesn't attempt to get the ipv6 address in your environment.

We will be deprecating these methods as we move support for all the data being submitted over to the new method, as it is no longer dependent on getting puppetdb access credentials to Puppet in order for data to continue to flow (and then also juggling expiring tokens). We've found this will also perform better with users with larger Puppet installations.

The Splunk App is here: https://splunkbase.splunk.com/app/4413/ which contains the dashboards and sourcetypes, while the module for sending the data is here (with a pending 0.5.0 update this week): https://forge.puppet.com/puppetlabs/splunk_hec