Splunk Docker migration is failing

[Nagaraju]

Hi Team,

I am working on migrating Splunk standard alone installation to docker images, as part of this I have copied etc and var folder to new server and mounted as volumes into container, I am getting the below error while it is launching the container. I have added a new password as environment variable while running the container. Am I missing anything during the migration?

TASK [splunk_standalone : Setup global HEC] ************************************
splunkenterprise_1 | fatal: [localhost]: FAILED! => {
splunkenterprise_1 | "cache_control": "private",
splunkenterprise_1 | "changed": false,
splunkenterprise_1 | "connection": "Close",
splunkenterprise_1 | "content_length": "130",
splunkenterprise_1 | "content_type": "text/xml; charset=UTF-8",
splunkenterprise_1 | "date": "Mon, 19 Apr 2021 09:51:12 GMT",
splunkenterprise_1 | "elapsed": 0,
splunkenterprise_1 | "redirected": false,
splunkenterprise_1 | "server": "Splunkd",
splunkenterprise_1 | "status": 401,
splunkenterprise_1 | "url": "https://127.0.0.1:8089/services/data/inputs/http/http",
splunkenterprise_1 | "vary": "Cookie, Authorization",
splunkenterprise_1 | "www_authenticate": "Basic realm=\"/splunk\"",
splunkenterprise_1 | "x_content_type_options": "nosniff",
splunkenterprise_1 | "x_frame_options": "SAMEORIGIN"
splunkenterprise_1 | }
splunkenterprise_1 |
splunkenterprise_1 | MSG:
splunkenterprise_1 |
splunkenterprise_1 | Status code was 401 and not [200]: HTTP Error 401: Unauthorized
splunkenterprise_1 |
splunkenterprise_1 | PLAY RECAP *********************************************************************
splunkenterprise_1 | localhost : ok=56 changed=2 unreachable=0 failed=1 skipped=58 rescued=0 ignored=0

[aasabatini]

Hi @Nagaraju 

please check on this page if there is any violation on your migration

https://github.com/splunk/docker-splunk/blob/master/docs/SUPPORT.md#support-violation

Regards

Alessandro

[Nagaraju]

Does this mean splunk doesn't support for issues if we host it in containers?

[aasabatini]

Hi @Nagaraju 

if a container on a platform not officially supported by Splunk, yes is not supported.

anyway check on your configuration is all fine follow the github page.
https://github.com/splunk/docker-splunk/tree/master

Or

https://docs.splunk.com/Documentation/Splunk/8.1.3/Installation/DeployandrunSplunkEnterpriseinsideDo...

Alessandro