When we start official Docker container image splunk/splunk:9.2.1 with extra var SPLUNK_DISABLE_POPUPS=true
docker run -d -p 8000:8000 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=OUR_PASS" -e "SPLUNK_DISABLE_POPUPS=true" --name splunk splunk/splunk:9.2.1
The Ansible task Disable Popups fails, with this error message:
TASK [splunk_common : Disable Popups] ******************************************
changed: [localhost] => (item={'key': '/servicesNS/admin/user-prefs/data/user-prefs/general', 'value': 'hideInstrumentationOptInModal=1¬ification_python_3_impact=false&showWhatsNew=0'})
failed: [localhost] (item={'key': '/servicesNS/nobody/splunk_instrumentation/admin/telemetry/general', 'value': 'showOptInModal=0&optInVersionAcknowledged=4'}) => {
"ansible_loop_var": "item",
"changed": false,
"item": {
"key": "/servicesNS/nobody/splunk_instrumentation/admin/telemetry/general",
"value": "showOptInModal=0&optInVersionAcknowledged=4"
}
}
MSG:
POST/servicesNS/nobody/splunk_instrumentation/admin/telemetry/generaladmin********8089{'showOptInModal': '0&optInVersionAcknowledged=4'}NoneNone[200, 201, 409];;; AND excep_str: URL: https://127.0.0.1:8089/servicesNS/nobody/splunk_instrumentation/admin/telemetry/general; data: {"showOptInModal": "0&optInVersionAcknowledged=4"}, exception: API call for https://127.0.0.1:8089/servicesNS/nobody/splunk_instrumentation/admin/telemetry/general and data as {'showOptInModal': '0&optInVersionAcknowledged=4'} failed with status code 400: <?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Argument "{"showOptInModal": "0" is not supported by this handler.</msg>
</messages>
</response>
, failed with status code 400: <?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Argument "{"showOptInModal": "0" is not supported by this handler.</msg>
</messages>
</response>
failed: [localhost] (item={'key': '/servicesNS/admin/search/data/ui/ui-tour/search-tour', 'value': 'tourPage=search&viewed=1'}) => {
"ansible_loop_var": "item",
"changed": false,
"item": {
"key": "/servicesNS/admin/search/data/ui/ui-tour/search-tour",
"value": "tourPage=search&viewed=1"
}
}
MSG:
POST/servicesNS/admin/search/data/ui/ui-tour/search-touradmin********8089{'tourPage': 'search&viewed=1'}NoneNone[200, 201, 409];;; AND excep_str: URL: https://127.0.0.1:8089/servicesNS/admin/search/data/ui/ui-tour/search-tour; data: {"tourPage": "search&viewed=1"}, exception: API call for https://127.0.0.1:8089/servicesNS/admin/search/data/ui/ui-tour/search-tour and data as {'tourPage': 'search&viewed=1'} failed with status code 400: <?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Argument "{"tourPage": "search" is not supported by this handler.</msg>
</messages>
</response>
, failed with status code 400: <?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Argument "{"tourPage": "search" is not supported by this handler.</msg>
</messages>
</response>
Because of this the container fail to start.
When the Disable Popups variable is not given Splunk starts without issue.
Other Docker image versions, like splunk/splunk:9.2 doesn't have this issue.
Any help is appreciated.