Workarounds to run 9.4 with KVStore on Docker for Mac running on Apple Silicon (M1-M4)

Splunk 9.4 uses mongod 7 which does not run under Rosetta2 (see https://www.mongodb.com/community/forums/t/mongo-5-on-apple-m1-laptops-via-docker/136506 )

So by hacking around I kind of made it work by switching back to mongod-4.2

1. Removed mongod link to mongo-7.0 (file /opt/splunk/bin/mongod )

2. Instead wrote a bash script that will pass everything to mongod-4.2 (see below)

3. In bash script get rid of one parameter that is not supported by mongod-4.2 --setParameter=minSnapshotHistoryWindowInSeconds=5

4. Made bash script executable. (chmod +x /opt/splunk/bin/mongod)

Script:

#!/bin/bash

# Define an array to store filtered arguments
filtered_args=()

# Iterate over all input arguments
while [[ $# -gt 0 ]]; do
    case "$1" in
        --setParameter=minSnapshotHistoryWindowInSeconds=5)
            shift  # Skip this parameter
            ;;
        *)
            filtered_args+=("$1")
            shift
            ;;
    esac
done

# Execute /opt/splunk/bin/mongod-4.2 with the filtered arguments
exec /opt/splunk/bin/mongod-4.2 "${filtered_args[@]}"

It seems like that made it to work.

Curious if there are any better workarounds or better compatibility? I know it is not very supported scenario running Splunk under rosetta, but a LOT of developers use it in that configuration.

Start by reproducing Splunk 9.4 KVStore on Docker for Mac with Apple Silicon and review the reported changes to /opt/splunk/bin/mongod, including the mongod-4.2 wrapper and filtered parameter. Check whether the workaround is reproducible and whether a supported compatibility path can be identified. Done requires a clearly documented, validated workaround or compatibility outcome.