the contents of inputs.conf get reset.

tt-nexteng — Mon, 03 Mar 2025 06:14:06 GMT

I am running a Splunk Indexer on Docker in an EC2 instance. I use the following Compose file to start the service. However, every time I restart the EC2 instance, the contents of inputs.conf get reset.

version: "3.6" networks: splunknet: driver: bridge attachable: true volumes: splunk-var: external: true splunk-etc: external: true services: splunk: networks: splunknet: aliases: - splunk image: xxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/splunk/splunk:latest container_name: splunk restart: always environment: - SPLUNK_START_ARGS=--accept-license - SPLUNK_PASSWORD=password ports: - "80:8000" - "9997:9997" volumes: - splunk-var:/opt/splunk/var - splunk-etc:/opt/splunk/etc

The following is my conf.

[splunktcp-ssl:9997] disabled = 0 [SSL] serverCert = /opt/splunk/etc/auth/mycerts/myCombinedServerCertificate.pem sslPassword = password requireClientCert = false

Re: the contents of inputs.conf get reset.

livehybrid — Mon, 03 Mar 2025 07:12:54 GMT

Hi @tt-nexteng

How are you loading your inputs.conf into the Docker image? Are you adding directly into the container once it has started up? Splunk Ansible runs each time the container starts, therefore the container is fairly idempotent and will apply the configuration defined in default.yml / docker-compose ENV variables when started.

Check out https://splunk.github.io/docker-splunk/ADVANCED.html for some configuration options you might want to look at to persist the inputs.conf - Specifically the section around enabling SSL as this has the config for inputs on port 9997 too!
https://splunk.github.io/docker-splunk/ADVANCED.html#:~:text=distributed%2C%20containerized%20environment.-,Enable%20SSL%20Internal%20Communication,-To%20secure%20network

Sample default.yml snippet to configure Splunk TCP with SSL:

splunk: ... s2s: ca: /mnt/certs/ca.pem cert: /mnt/certs/cert.pem enable: true password: abcd1234 port: 9997 ssl: true ...

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

topic the contents of inputs.conf get reset. in Splunk Enterprise

the contents of inputs.conf get reset.

Re: the contents of inputs.conf get reset.