Getting Data In

Deploying Custom Splunk Docker Image Ansible Issue

jgonsalves575
New Member

Hi all,

Right now I'm just trying to deploy a Docker container with Splunk installed from an image built from source (from Splunk's GH page: https://github.com/splunk/docker-splunk). The custom elements will come later, I'm just trying to get the default splunk-centos-7 image to work.

I'm running inside a Centos 8 VM with Docker installed. I believe this is a configuration issue, but I can't find anything online mentioning what to do.

My workflow from inside the cloned repo dir:

  • Make the image (this is straight from the master branch)
    sudo make splunk-centos-7

  • This successfully builds the image. Then, I run (with the proper password):
    sudo docker run -it -p 8000:8000 -e "SPLUNK_PASSWORD=<password>" -e "SPLUNK_START_ARGS=--accept-license" <image ID>

    • This causes entrypoint.sh to eventually run ansible-playbook $ANSIBLE_EXTRA_FLAGS -i inventory/environ.py site.yml
  • This is where my issue is - I get the error:
    TASK [Provision role] ***********************************************************************************************************************************************************************************************************************
    [WARNING]: 'splunk' is undefined

I've tried the recommendation at https://splunk.github.io/splunk-ansible/EXAMPLES.html#provision-local-standalone and running with a default.yml file, but I get an Ansible error when including the splunk_standalone role.

It feels like I'm missing some configuration somewhere. The build succeeds, but trying to run the container fails. Does anyone have any suggestions?

0 Karma

jgonsalves575
New Member

Never received an answer on building from source, but I found a work around for my need.

I was trying to STIG a Splunk container, so all I had to do was make a Dockerfile using splunk/splunk:latest as the the base image, and copy/run a bash script in there.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...