We are trying to run the splunk forwarder local to fix few vulnerabilities and getting the following error message and stopped. Can you please help with fix for this?
Dockerfile: FROM splunk/universalforwarder:9:3
Commands run:
docker build -t suf .
docker run -d -p 9997:9997 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=changeme" --name uf suf
2025-04-01 06:40:50
2025-04-01 06:40:50 TASK [splunk_universal_forwarder : include_tasks] ******************************
2025-04-01 06:40:50 included: /opt/ansible/roles/splunk_universal_forwarder/tasks/../../../roles/splunk_common/tasks/check_for_required_restarts.yml for localhost
2025-04-01 06:40:50 Tuesday 01 April 2025 13:40:50 +0000 (0:00:00.045) 0:00:19.675 *********
2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (5 retries left).
2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (4 retries left).
2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (3 retries left).
2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (2 retries left).
2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (1 retries left).
2025-04-01 06:41:23
2025-04-01 06:41:23 TASK [splunk_universal_forwarder : Check for required restarts] ****************
2025-04-01 06:41:23 fatal: [localhost]: FAILED! => {
2025-04-01 06:41:23 "attempts": 5,
2025-04-01 06:41:23 "changed": false,
2025-04-01 06:41:23 "changed_when_result": "The conditional check 'restart_required.status == 200' failed. The error was: error while evaluating conditional (restart_required.status == 200): 'dict object' has no attribute 'status'. 'dict object' has no attribute 'status'"
2025-04-01 06:41:23 }
2025-04-01 06:41:23
2025-04-01 06:41:23 MSG:
2025-04-01 06:41:23
2025-04-01 06:41:23 GET/services/messages/restart_required?output_mode=jsonadmin********8089NoneNoneNone[200, 404];;; failed with NO RESPONSE and EXCEP_STR as Not supported URL scheme http+unix
2025-04-01 06:41:23
2025-04-01 06:41:23 PLAY RECAP *********************************************************************
2025-04-01 06:41:23 localhost : ok=68 changed=2 unreachable=0 failed=1 skipped=81 rescued=0 ignored=0
2025-04-01 06:41:23
2025-04-01 06:41:23 Tuesday 01 April 2025 13:41:23 +0000 (0:00:33.184) 0:00:52.859 *********
Try adding this additional ARG on startup - I don't know the syntax for docker so google it please.
--no-prompt