---
- name: Install and configure Splunk Universal Forwarder on Windows
  hosts: windows
  collections:
    - ansible.windows
  vars:
    splunk_msi_url: http://<servidor_passo_2>/agent/splunkforwarder-10.0.1-c486717c322b-windows-x64.msi'
    splunk_msi_file: 'splunkforwarder-10.0.1-c486717c322b-windows-x64.msi'
    splunk_install_dir: 'C:\Program Files\SplunkUniversalForwarder'
    splunk_user: 'Administrator'
    log_sourcetype: 'wineventlog'
    log_path: 'WinEventLog:Application'

  tasks:
    - name: Include variables for the splunk settings
      ansible.builtin.include_vars:
        dir: vars
        extensions:
          - 'yaml'
          - 'yml'

    - name: Check if Splunk Universal Forwarder is installed
      ansible.windows.win_shell: |
        if (Test-Path -Path 'C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe') { exit 0 } else { exit 1 }
      args:
        executable: powershell.exe
      register: splunk_check
      ignore_errors: yes
      collections:
        - ansible.windows

    - name: Stopping Splunk
      win_shell: |
        "{{ splunk_install_dir }}\bin\splunk.exe" stop
      args:
        executable: cmd.exe
      when: splunk_check.rc == 0
      ignore_errors: yes

    - name: Disable Splunk to start on boot
      win_shell: |
        "{{ splunk_install_dir }}\bin\splunk.exe" disable boot-start
      args:
        executable: cmd.exe
      when: splunk_check.rc == 0
      ignore_errors: yes

    - name: Uninstall Splunk Universal Forwarder if installed
      ansible.windows.win_package:
        path: 'C:\Temp\{{ splunk_msi_file }}'
        state: absent
      when: splunk_check.rc == 0
      ignore_errors: yes
      collections:
        - ansible.windows

    - name: Ensure Temp directory exists
      win_file:
        path: 'C:\Temp'
        state: directory

    - name: Download Splunk Universal Forwarder MSI
      win_get_url:
        url: '{{ splunk_msi_url }}'
        dest: 'C:\Temp\{{ splunk_msi_file }}'

    - name: Install Splunk Universal Forwarder
      win_package:
        path: 'C:\Temp\{{ splunk_msi_file }}'
        product_id: '{Splunk-UniversalForwarder}' 
        arguments: '/quiet AGREETOLICENSE=Yes SPLUNKUSERNAME=admin SPLUNKPASSWORD={{ splunk_admin_password }} WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 WINEVENTLOG_FWD_ENABLE=1 WINEVENTLOG_SET_ENABLE=1 PERFMON=cpu,memory,network,diskspace DEPLOYMENT_SERVER="{{ deployment_server }}" INSTALLDIR="{{ splunk_install_dir }}"'
      register: splunk_install
      failed_when: splunk_install.rc != 0 and splunk_install.rc != 3010 # 3010 indica reboot necessário

    - name: Ensure Splunk local directory exists
      ansible.windows.win_file:
        path: '{{ splunk_install_dir }}\etc\system\local'
        state: directory
      collections:
        - ansible.windows

    - name: Check if inputs.conf exists
      ansible.windows.win_stat:
        path: '{{ splunk_install_dir }}\etc\system\local\inputs.conf'
      register: inputs_conf_stat
      collections:
        - ansible.windows

    - name: Create or update inputs.conf with default index
      ansible.windows.win_copy:
        content: |
          [default]
          index = serv_win
        dest: '{{ splunk_install_dir }}\etc\system\local\inputs.conf'
      when: not inputs_conf_stat.stat.exists or inputs_conf_stat.stat.content is not search('index = serv_win')
      collections:
        - ansible.windows

    - name: Start Splunk Universal Forwarder
      win_shell: |
        "{{ splunk_install_dir }}\bin\splunk.exe" start
      args:
        executable: cmd.exe

    - name: Configure Splunk to forward data to Indexer
      win_shell: |
        "{{ splunk_install_dir }}\bin\splunk.exe" add forward-server {{ indexer_ip }}:{{ indexer_port }} -auth admin:{{ splunk_admin_password }}
      args:
        executable: cmd.exe
      ignore_errors: yes

    - name: Configure Splunk Deployment Server
      win_shell: |
        "{{ splunk_install_dir }}\bin\splunk.exe" set deploy-poll {{ deployment_server }} -auth admin:{{ splunk_admin_password }}
      args:
        executable: cmd.exe
      ignore_errors: yes

    - name: Configure Log Folder
      win_shell: |
        "{{ splunk_install_dir }}\bin\splunk.exe" add monitor “D:\Logs\---” -index application_log -auth admin:{{ splunk_admin_password }}
      args:
        executable: cmd.exe
      ignore_errors: yes


    - name: Restarting Splunk UF
      win_shell: |
        "{{ splunk_install_dir }}\bin\splunk.exe" restart
      args:
        executable: cmd.exe
      ignore_errors: yes


    - name: Ensure Splunk service is running
      win_service:
        name: SplunkForwarder
        state: started
        start_mode: auto

    - name: Clean up downloaded MSI file
      win_file:
        path: 'C:\Temp\{{ splunk_msi_file }}'
        state: absent

