topic Re: docker splunk-url format error in Getting Data In

docker splunk-url format error

rabinutam — Tue, 29 Sep 2020 13:25:08 GMT

With docker run cmd, I used: --log-opt splunk-url=https://mysplunkexample.com:8088/services/collector
docker cmd: docker run --log-driver=splunk --log-opt splunk-url=https://mysplunkexample.com:8088/services/collector ... other options ... image:tag

which gives following error:
docker: Error response from daemon: Failed to initialize logging driver: splunk: expected format scheme://dns_name_or_ip:port for splunk-url.

Splunk Enterprise path is: https://mysplunkexample.com:8088/services/collector
and not: https://mysplunkexample.com:8088

I would appreciate any solution to this issue.

Re: docker splunk-url format error

sloshburch — Mon, 03 Apr 2017 14:40:09 GMT

I assume you've seen this link, but adding it in case it helps in our discussion:
https://docs.docker.com/engine/admin/logging/splunk/

From what I can tell in the docs, you should be using just the scheme, host, and port but no URI. So that means in your example, I would assume this should work: docker run --log-driver=splunk --log-opt splunk-url=https://mysplunkexample.com:8088
The logging driver in docker will resolve what endpoint to post to.

Let us know how you make out?

Re: docker splunk-url format error

a548506 — Mon, 03 Apr 2017 15:39:29 GMT

Burch,

Per our conversation here is the curl command that we've both used to test things out. Both myself and Prabin have used it to send it to our dev environment:

curl -k https://:8088/services/collector -H 'Authorization: Splunk ,' -d '{"sourcetype": "mysourcetype", "event":"Hello, World!"}'

Thanks,
Burch

Re: docker splunk-url format error

sloshburch — Tue, 04 Apr 2017 12:12:11 GMT

Did you spot the difference? You tested with a curl command, for which you had to specify the URI. But the docker logging driver implies that you only need to list the schema://hostname:port and it will resolve the URI. See my answer above for an example and let me know how that works out in the docker instance.

Re: docker splunk-url format error

rabinutam — Wed, 05 Apr 2017 17:27:44 GMT

Burch, thank you for your response.

I tried just with scheme, host, and port as well,
but that gave different error

docker cmd: docker run --log-driver=splunk --log-opt splunk-token=abcd --log-opt splunk-url=https://mysplunkexample.com:8088 ... other options ... image:tag
gives following error
docker: Error response from daemon: Failed to initialize logging driver: x509: certificate is valid for SplunkServerDefaultCert, not vlmmk301

The splunk-token I used is correct and tested with curl to successfully send event message.

Re: docker splunk-url format error

sloshburch — Mon, 10 Apr 2017 12:31:13 GMT

The message implies SSL certificate stuff. Check the options on https://docs.docker.com/engine/admin/logging/splunk/#splunk-options for things like the splunk-caname and so forth.

Re: docker splunk-url format error

cruizba — Tue, 15 Sep 2020 12:18:29 GMT

I confirm that this is not working today. At least for trial versions in splunk cloud. The certificate at port 8088 is not valid and docker can't run

Re: docker splunk-url format error

cruizba — Wed, 16 Sep 2020 08:42:33 GMT

I was able to run the trial version using the argument in the docker run

--log-opt splunk-insecureskipverify=true

It would be nice to operate with verificated certificates in trial versions.