Getting Data In

Deploying Custom Splunk Docker Image Ansible Issue

jgonsalves575
New Member

Hi all,

Right now I'm just trying to deploy a Docker container with Splunk installed from an image built from source (from Splunk's GH page: https://github.com/splunk/docker-splunk). The custom elements will come later, I'm just trying to get the default splunk-centos-7 image to work.

I'm running inside a Centos 8 VM with Docker installed. I believe this is a configuration issue, but I can't find anything online mentioning what to do.

My workflow from inside the cloned repo dir:

  • Make the image (this is straight from the master branch)
    sudo make splunk-centos-7

  • This successfully builds the image. Then, I run (with the proper password):
    sudo docker run -it -p 8000:8000 -e "SPLUNK_PASSWORD=<password>" -e "SPLUNK_START_ARGS=--accept-license" <image ID>

    • This causes entrypoint.sh to eventually run ansible-playbook $ANSIBLE_EXTRA_FLAGS -i inventory/environ.py site.yml
  • This is where my issue is - I get the error:
    TASK [Provision role] ***********************************************************************************************************************************************************************************************************************
    [WARNING]: 'splunk' is undefined

I've tried the recommendation at https://splunk.github.io/splunk-ansible/EXAMPLES.html#provision-local-standalone and running with a default.yml file, but I get an Ansible error when including the splunk_standalone role.

It feels like I'm missing some configuration somewhere. The build succeeds, but trying to run the container fails. Does anyone have any suggestions?

0 Karma

jgonsalves575
New Member

Never received an answer on building from source, but I found a work around for my need.

I was trying to STIG a Splunk container, so all I had to do was make a Dockerfile using splunk/splunk:latest as the the base image, and copy/run a bash script in there.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...