Splunk workload management (WLM) in a container
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 549
- Forks
- 277
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 2
Description
We'd like to migrate our Splunk cluster to using containers and the docker-splunk image, however the last remaining blocker that we've identified is that we cannot enable the workload management config in the container in recent version of Splunk (>= 7.3)
It fails the pre-flight checks :
Workload Management Preflight Checks failed. Fix the following issues:
CPU Splunk base directory Splunkd.service requires read and write permissions.
CPU Splunk base directory Splunkd.service is missing.
The 'Delegate' property in the unit file must be set to 'true'. Restart Splunk then rerun preflight checks.
In the unit file, the 'Restart' property must be set to 'always'. The 'ExecStart' property must include '_internal_launch_under_systemd'. Make sure the up-to-date unit file is loaded.
Memory Splunk base directory Splunkd.service requires read and write permissions.
Memory Splunk base directory Splunkd.service is missing.
Unit file Splunkd.service is missing. Restart Splunk then rerun preflight checks.
bin/splunk version
Splunk 7.3.5 (build 86fd62efc3d7)
It appears to be looking for a systemd unit and the associated cgroups - which obviously doesn't exist in the container.
I understand this is not an issue with docker-splunk per say, but it would be nice to find a workaround as running no systemd unit is a common container behaviour.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the docker-splunk image and the Splunk 7.3.5 workload management pre-flight output. Investigate how the checks depend on the missing systemd unit and associated cgroups in a container. Done means documenting or validating a workable way to enable WLM without a systemd unit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100