Getting Data In

running splunk with docker - ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment

Path Finder

hello
I was testing Docker as an easy solution to roam Splunk. I have encounter an issue and need your help.

Here are the steps I took:

  1. Created a fresh Splunk container using an official article: https://docs.splunk.com/Documentation/Splunk/7.2.4/Installation/DeployandrunSplunkEnterpriseinsideDo...
  2. I have connect to the Splunk app through the web and uploaded a csv to have some data
  3. I have stopped the container and created an image
  4. I have moved the image and run it on another host

On the other host I receive the below error messages.

fatal: [localhost]: FAILED! =>
{"changed": false, "cmd":
["/opt/splunk/bin/splunk",
"hash-passwd", "Xpktbe!23"], "delta":
"0:00:00.314896", "end": "2019-03-27
09:56:43.305836", "msg": "non-zero
return code", "rc": 8, "start":
"2019-03-27 09:56:42.990940",
"stderr": "", "stderrlines": [],
"stdout": "ERROR: Couldn't determine
$SPLUNK
HOME or $SPLUNKETC; perhaps
one should be set in environment",
"stdout
lines": ["ERROR: Couldn't
determine $SPLUNKHOME or $SPLUNKETC;
perhaps one should be set in
environment"]}
to retry, use: --limit @/opt/container_artifact/ansible-retry/site.retry
PLAY RECAP
********************************************************************* localhost : ok=18

changed=1 unreachable=0 failed=1

ERROR: Couldn't read
"/opt/splunk/etc/splunk-launch.conf"
-- maybe $SPLUNKHOME or $SPLUNKETC is set wrong?

can someone help ?
thanks

0 Karma
1 Solution

Engager

I had the same error due to SELinux enabled. Disabling it (/etc/selinux/config SELINUX=disabled) solve my problem.

View solution in original post

0 Karma

Engager

I had the same error due to SELinux enabled. Disabling it (/etc/selinux/config SELINUX=disabled) solve my problem.

View solution in original post

0 Karma

Path Finder

any idea ?

0 Karma

Splunk Employee
Splunk Employee

Hi! Usually this comes down to the volume mounts missing or needing to be updated. Can you share your swarm file?

0 Karma