Installation

Cannot Validate Docker Install - ERROR Validating Installation

samdc98
Observer

I have installled splunk/splunk:latest and exposed it on 8000 per the instructions
I can get to the GUI on localhost:8000 and retrieved a HEC token

when I try to validate the install using

curl -k https://localhost:8088/services/collector/event -H "Authorization: Splunk my-hec-token" -d '{"event": "hello world"}'

I get this ERROR

Failed to connect to localhost port 8088: Connection refused

Note: I am using the correct token

Labels (1)
0 Karma

samdc98
Observer

Looks like that exposes a number of ports, docker ps -a gives 


8065/tcp, 8088-8089/tcp, 8191/tcp, 9887/tcp, 0.0.0.0:8000->8000/tcp, :::8000->8000/tcp, 9997/tcp splunk

So I guess that means 8088 is automatically exposed?

 

0 Karma

samdc98
Observer

the instructions on hub.docker.com say to expose 8000
docker run -d -p 8000:8000 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=xxxxxxxxxx" --name splunk splunk/splunk:latest

Using this I can navigate to the GUI   localhost:8000

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samdc98 

Not sure about the default ports exposed during docker run but you can try by exposing manually

docker run -d -p 8000:8000 -8088:8088 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=xxxxxxxxxx" --name splunk splunk/splunk:latest

KV

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samdc98 

did you exposed 8088 from docker container ? 

-p 8088:8088

 

KV

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...