Splunk fails to start without content message
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 549
- Forks
- 277
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 2
Description
Hi team,
I'm using Splunk Enterprise with 1year license(my license will expire on Jul 14th). This morning, I have restarted server, and then start docker by command docker-compose up -d, Unfortunately, bellow error is coming without content message.
splunk | included: /opt/ansible/roles/splunk_standalone/tasks/../../splunk_common/tasks/set_as_hec_receiver.yml for localhost
splunk | Monday 04 July 2022 14:59:54 +0900 (0:00:00.052) 0:01:35.307 ***********
splunk |
splunk | TASK [splunk_standalone : Setup global HEC] ************************************
splunk | task path: /opt/ansible/roles/splunk_common/tasks/set_as_hec_receiver.yml:4
splunk | fatal: [localhost]: FAILED! => {
splunk | "cache_control": "private",
splunk | "changed": false,
splunk | "connection": "Close",
splunk | "content_length": "130",
splunk | "content_type": "text/xml; charset=UTF-8",
splunk | "date": "Mon, 04 Jul 2022 05:59:55 GMT",
splunk | "elapsed": 0,
splunk | "redirected": false,
splunk | "server": "Splunkd",
splunk | "status": 401,
splunk | "url": "https://127.0.0.1:8089/services/data/inputs/http/http",
splunk | "vary": "Cookie, Authorization",
splunk | "www_authenticate": "Basic realm=\"/splunk\"",
splunk | "x_content_type_options": "nosniff",
splunk | "x_frame_options": "SAMEORIGIN"
splunk | }
splunk |
splunk | MSG:
splunk |
splunk | Status code was 401 and not [200]: HTTP Error 401: Unauthorized
splunk |
splunk | PLAY RECAP *********************************************************************
splunk | localhost : ok=58 changed=2 unreachable=0 failed=1 skipped=60 rescued=0 ignored=0
splunk |
docker-compose.yml
version: '3.1'
services:
splunk:
image: splunk/splunk:8.2.2
container_name: splunk
environment:
SPLUNK_START_ARGS: --accept-license
SPLUNK_ADD: tcp 1514
SPLUNK_ENABLE_LISTEN: 9997
SPLUNK_PASSWORD: *********
ANSIBLE_EXTRA_FLAGS: -vv
TZ: Asia/Tokyo
DEBUG: "true"
SPLUNK_DEFAULTS_URL: https://***.com/splunk.yml
ports:
- "8000:8000"
- "9997:9997"
- "8088:8088"
- "1514:1514"
networks:
- ***
dns:
- 8.8.8.8
- 8.8.4.4
volumes:
- opt-splunk-etc-1:/opt/splunk/etc
- opt-splunk-var:/opt/splunk/var
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with docker-compose.yml and the splunk_standalone task at /opt/ansible/roles/splunk_common/tasks/set_as_hec_receiver.yml. Reproduce the startup command and inspect the request to https://127.0.0.1:8089/services/data/inputs/http/http; done means the container starts without the reported HTTP 401 failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, docker-compose, python
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100