Deployment Architecture

Splunkforwarder 9:.3 failing in docker desktop

bhupalbobbadi
Path Finder

We are trying to run the splunk forwarder local to fix few vulnerabilities and getting the following error message and stopped. Can you please help with fix for this?

 

 

Dockerfile: FROM splunk/universalforwarder:9:3

 

Commands run:

docker build -t suf .
docker run -d -p 9997:9997 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=changeme" --name uf suf

 

 

2025-04-01 06:40:50

2025-04-01 06:40:50 TASK [splunk_universal_forwarder : include_tasks] ******************************

2025-04-01 06:40:50 included: /opt/ansible/roles/splunk_universal_forwarder/tasks/../../../roles/splunk_common/tasks/check_for_required_restarts.yml for localhost

2025-04-01 06:40:50 Tuesday 01 April 2025  13:40:50 +0000 (0:00:00.045)       0:00:19.675 *********

2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (5 retries left).

2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (4 retries left).

2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (3 retries left).

2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (2 retries left).

2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (1 retries left).

2025-04-01 06:41:23

2025-04-01 06:41:23 TASK [splunk_universal_forwarder : Check for required restarts] ****************

2025-04-01 06:41:23 fatal: [localhost]: FAILED! => {

2025-04-01 06:41:23     "attempts": 5,

2025-04-01 06:41:23     "changed": false,

2025-04-01 06:41:23     "changed_when_result": "The conditional check 'restart_required.status == 200' failed. The error was: error while evaluating conditional (restart_required.status == 200): 'dict object' has no attribute 'status'. 'dict object' has no attribute 'status'"

2025-04-01 06:41:23 }

2025-04-01 06:41:23

2025-04-01 06:41:23 MSG:

2025-04-01 06:41:23

2025-04-01 06:41:23 GET/services/messages/restart_required?output_mode=jsonadmin********8089NoneNoneNone[200, 404];;; failed with NO RESPONSE and EXCEP_STR as Not supported URL scheme http+unix

2025-04-01 06:41:23

2025-04-01 06:41:23 PLAY RECAP *********************************************************************

2025-04-01 06:41:23 localhost                  : ok=68   changed=2    unreachable=0    failed=1    skipped=81   rescued=0    ignored=0  

2025-04-01 06:41:23

2025-04-01 06:41:23 Tuesday 01 April 2025  13:41:23 +0000 (0:00:33.184)       0:00:52.859 *********

Labels (1)
0 Karma

dural_yyz
Motivator

Try adding this additional ARG on startup - I don't know the syntax for docker so google it please.

 

--no-prompt
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...