Deployment Architecture

AWS Elastic Beanstalk Failing to Set Up Splunk Universal Forwarder User

yourknightmares
Explorer

I'm attempting to set up my AWS Elastic Beanstalk instance to also run Splunk Universal Forwarder on it and forward data to my Splunk Cloud account. I am roughly following this guide: https://tech.smartling.com/logs-collection-from-aws-elasticbeanstalk-splunk-7edd0348bc96 with some changes to the .ebextensions file given. I know it's using an older version of universal forwarder, so the admin:changeme login doesn't work, but I went on to this page: https://docs.splunk.com/Documentation/Splunk/7.1.0/Security/Secureyouradminaccount#Create_a_password... and followed that by creating a user-seed.conf file with a random password, I even added a cat on that file and it printed out the correct information. However, I'm still getting the "No users exist. Please set up a user." error. Does anyone have any ideas?

Here's my actual .ebextensions file:

 

 

container_commands:
    01install-splunk:
        command: /usr/local/bin/install-splunk.sh
    02set-splunk-outputs:
        command: /usr/local/bin/set_splunk_outputs.sh
        env:
            SPLUNK_SERVER_HOST: "instance.splunkcloud.com:9997"
    03add-inputs-to-splunk:
        command: /usr/local/bin/add-inputs-to-splunk.sh
        env:
            ENVIRONMENT_NAME: "Development"
        cwd: /root
        ignoreErrors: false 

files:
    "/usr/local/bin/install-splunk.sh":
        content: |
            #!/usr/bin/env bash

            /usr/bin/wget "https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.1.0&product=universalforwarder&filename=splunkforwarder-8.1.0-f57c09e87251-linux-2.6-x86_64.rpm&wget=true" -O /usr/src/splunk-universal-forwarder.rpm
            /bin/rpm -i /usr/src/splunk-universal-forwarder.rpm

            if [[ -z $(pgrep splunk) ]];then
                /opt/splunkforwarder/bin/splunk start --answer-yes --no-prompt --accept-license
            fi
        mode: "000755"
    "/opt/splunkforwarder/etc/system/local/outputs.conf":
        content: |
            [tcpout]
            defaultGroup = splunkLogs
            disabled = false

            [tcpout:splunkLogs]
            server = splunk_server_host

            [tcpout-server://splunk-server-host:9997]
        mode: "000644"
    "/usr/local/bin/set_splunk_outputs.sh":
        content: |
            #!/usr/bin/env bash

            if [[ -z $SPLUNK_SERVER_HOST ]];then
                echo "$0: Cannot find splunk server host."
                exit 1
            fi

            outputs_file="/opt/splunkforwarder/etc/system/local/outputs.conf"
            if [[ -e $outputs ]];then
                chown splunk.splunk $outputs
                cp -f $outputs_file $outputs_file.orig
                sed -i "s/splunk_server_host/$SPLUNK_SERVER_HOST/g" $outputs

                if [[ -n $(diff $outputs_file $outputs_file.orig) && -n $(pgrep splunk) ]];then
                    /opt/splunkforwarder/bin/splunk restart
                fi
            fi
        mode: "000755"
    "/opt/splunkforwarder/etc/system/local/user-seed.conf":
        content: |
            [user_info]
            USERNAME = admin
            PASSWORD = "fdsajigoqpkmgas"
    "/usr/local/bin/add-inputs-to-splunk.sh":
        content: |
            #!/usr/bin/env bash

            application_name=$ENVIRONMENT_NAME
            instance_name=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
            splunk_logs_hostname="$application_name/$instance_name"
            wget "https://bucket.s3.amazonaws.com/splunkclouduf.spl" -O /usr/src/splunk-credentials.spl

            export HOME=/root
            /opt/splunkforwarder/bin/splunk install app /usr/src/splunk-credentials.spl -auth admin:"fdsajigoqpkmgas"
            /opt/splunkforwarder/bin/splunk login -auth admin:"fdsajigoqpkmgas"

            /opt/splunkforwarder/bin/splunk add monitor "/tmp/logs/stacktrace.log" -hostname "$splunk_logs_hostname" -sourcetype log4j
        mode: "000755"

 

 

smohanty_cme
Engager

Hi! I followed the same tutorial and ran into the same error while attempting to deploy. Have you found any success with this yet? Thanks

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...