Service ensure defaults to 'running' for the Splunk Enterprise and Splunk Forwarder services. It should be a parameter so users can toggle it. Issue created per: https://github.com/voxpupuli/puppet-splunk/pull/243