splunk / splunk/docker-splunk

Splunk workload management (WLM) in a container

Open
#375 4 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
549
Forks
277
Avg merge
3d 9h
Merged PRs (30d)
2

Description

We'd like to migrate our Splunk cluster to using containers and the docker-splunk image, however the last remaining blocker that we've identified is that we cannot enable the workload management config in the container in recent version of Splunk (>= 7.3)

It fails the pre-flight checks :

Workload Management Preflight Checks failed. Fix the following issues:
	CPU Splunk base directory Splunkd.service requires read and write permissions.
	CPU Splunk base directory Splunkd.service is missing.
	The 'Delegate' property in the unit file must be set to 'true'. Restart Splunk then rerun preflight checks.
	In the unit file, the 'Restart' property must be set to 'always'. The 'ExecStart' property must include '_internal_launch_under_systemd'. Make sure the up-to-date unit file is loaded.
	Memory Splunk base directory Splunkd.service requires read and write permissions.
	Memory Splunk base directory Splunkd.service is missing.
	Unit file Splunkd.service is missing. Restart Splunk then rerun preflight checks.
bin/splunk version
Splunk 7.3.5 (build 86fd62efc3d7)

It appears to be looking for a systemd unit and the associated cgroups - which obviously doesn't exist in the container.

I understand this is not an issue with docker-splunk per say, but it would be nice to find a workaround as running no systemd unit is a common container behaviour.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the docker-splunk image and the Splunk 7.3.5 workload management pre-flight output. Investigate how the checks depend on the missing systemd unit and associated cgroups in a container. Done means documenting or validating a workable way to enable WLM without a systemd unit.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.