Getting Data In

Unable to add splunk universal forwarder as a sidecar to a container in EKS

tkorrapati
Engager

ERROR OBSERVED

TASK [splunk_universal_forwarder : Setup global HEC] ***************************
task path: /opt/ansible/roles/splunk_common/tasks/set_as_hec_receiver.yml:4
fatal: [localhost]: FAILED! => {
    "cache_control": "private",
    "changed": false,
    "connection": "Close",
    "content_length": "130",
    "content_type": "text/xml; charset=UTF-8",
    "date": "Tue, 07 Dec 2021 09:34:20 GMT",
    "elapsed": 0,
    "redirected": false,
    "server": "Splunkd",
    "status": 401,
    "url": "https://127.0.0.1:8089/services/data/inputs/http/http",
    "vary": "Cookie, Authorization",
    "www_authenticate": "Basic realm=\"/splunk\"",
    "x_content_type_options": "nosniff",
    "x_frame_options": "SAMEORIGIN"
}

MSG:

Status code was 401 and not [200]: HTTP Error 401: Unauthorized

How I'm adding universal forwarder to my deployment in K8s

  - name: splunk-forwarder
    image: splunk/universalforwarder:8.2
    env:
      - name: SPLUNK_START_ARGS
        value: "--accept-license"
      - name: ANSIBLE_EXTRA_FLAGS
        value:  "-vv"
      - name: SPLUNK_CMD
        value: 'install app /tmp/splunk-creds/splunkclouduf.spl, add monitor /app/logs'
      - name: SPLUNK_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mia-env-secret
            key: SPLUNK_UF_PASSWORD
    resources: {}
    volumeMounts:
      - name: splunk-uf-creds-spl
        mountPath: tmp/splunk-creds
      - name: logs
        mountPath: /app/logs

There aren't many examples of how to use docker universalforwarder out there, any help or reference to how to containerized version of UF is appreciated.

Labels (1)

DukeScottWu
New Member

I have same question. From github we can get some example, but don't have enough explanation. 

Need some better documents

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...