splunk / splunk/docker-splunk

Splunk fails to start without content message

Open
#553 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
549
Forks
277
Avg merge
3d 9h
Merged PRs (30d)
2

Description

Hi team,
I'm using Splunk Enterprise with 1year license(my license will expire on Jul 14th). This morning, I have restarted server, and then start docker by command docker-compose up -d, Unfortunately, bellow error is coming without content message.

splunk                | included: /opt/ansible/roles/splunk_standalone/tasks/../../splunk_common/tasks/set_as_hec_receiver.yml for localhost
splunk                | Monday 04 July 2022  14:59:54 +0900 (0:00:00.052)       0:01:35.307 ***********
splunk                |
splunk                | TASK [splunk_standalone : Setup global HEC] ************************************
splunk                | task path: /opt/ansible/roles/splunk_common/tasks/set_as_hec_receiver.yml:4
splunk                | fatal: [localhost]: FAILED! => {
splunk                |     "cache_control": "private",
splunk                |     "changed": false,
splunk                |     "connection": "Close",
splunk                |     "content_length": "130",
splunk                |     "content_type": "text/xml; charset=UTF-8",
splunk                |     "date": "Mon, 04 Jul 2022 05:59:55 GMT",
splunk                |     "elapsed": 0,
splunk                |     "redirected": false,
splunk                |     "server": "Splunkd",
splunk                |     "status": 401,
splunk                |     "url": "https://127.0.0.1:8089/services/data/inputs/http/http",
splunk                |     "vary": "Cookie, Authorization",
splunk                |     "www_authenticate": "Basic realm=\"/splunk\"",
splunk                |     "x_content_type_options": "nosniff",
splunk                |     "x_frame_options": "SAMEORIGIN"
splunk                | }
splunk                |
splunk                | MSG:
splunk                |
splunk                | Status code was 401 and not [200]: HTTP Error 401: Unauthorized
splunk                |
splunk                | PLAY RECAP *********************************************************************
splunk                | localhost                  : ok=58   changed=2    unreachable=0    failed=1    skipped=60   rescued=0    ignored=0
splunk                |

docker-compose.yml

version: '3.1'

services:
  splunk:
    image: splunk/splunk:8.2.2
    container_name: splunk
    environment:
      SPLUNK_START_ARGS: --accept-license
      SPLUNK_ADD: tcp 1514
      SPLUNK_ENABLE_LISTEN: 9997
      SPLUNK_PASSWORD: *********
      ANSIBLE_EXTRA_FLAGS: -vv
      TZ: Asia/Tokyo
      DEBUG: "true"
      SPLUNK_DEFAULTS_URL: https://***.com/splunk.yml
    ports:
      - "8000:8000"
      - "9997:9997"
      - "8088:8088"
      - "1514:1514"
    networks:
      - ***
    dns:
      - 8.8.8.8
      - 8.8.4.4
    volumes:
      - opt-splunk-etc-1:/opt/splunk/etc
      - opt-splunk-var:/opt/splunk/var

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with docker-compose.yml and the splunk_standalone task at /opt/ansible/roles/splunk_common/tasks/set_as_hec_receiver.yml. Reproduce the startup command and inspect the request to https://127.0.0.1:8089/services/data/inputs/http/http; done means the container starts without the reported HTTP 401 failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, docker-compose, python
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.