Getting Data In

Deploying Custom Splunk Docker Image Ansible Issue

jgonsalves575
New Member

Hi all,

Right now I'm just trying to deploy a Docker container with Splunk installed from an image built from source (from Splunk's GH page: https://github.com/splunk/docker-splunk). The custom elements will come later, I'm just trying to get the default splunk-centos-7 image to work.

I'm running inside a Centos 8 VM with Docker installed. I believe this is a configuration issue, but I can't find anything online mentioning what to do.

My workflow from inside the cloned repo dir:

  • Make the image (this is straight from the master branch)
    sudo make splunk-centos-7

  • This successfully builds the image. Then, I run (with the proper password):
    sudo docker run -it -p 8000:8000 -e "SPLUNK_PASSWORD=<password>" -e "SPLUNK_START_ARGS=--accept-license" <image ID>

    • This causes entrypoint.sh to eventually run ansible-playbook $ANSIBLE_EXTRA_FLAGS -i inventory/environ.py site.yml
  • This is where my issue is - I get the error:
    TASK [Provision role] ***********************************************************************************************************************************************************************************************************************
    [WARNING]: 'splunk' is undefined

I've tried the recommendation at https://splunk.github.io/splunk-ansible/EXAMPLES.html#provision-local-standalone and running with a default.yml file, but I get an Ansible error when including the splunk_standalone role.

It feels like I'm missing some configuration somewhere. The build succeeds, but trying to run the container fails. Does anyone have any suggestions?

0 Karma

jgonsalves575
New Member

Never received an answer on building from source, but I found a work around for my need.

I was trying to STIG a Splunk container, so all I had to do was make a Dockerfile using splunk/splunk:latest as the the base image, and copy/run a bash script in there.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...