Splunk Enterprise

splunk 9.4.3 docker image failed to start

dbloms
Explorer

Hello,

I start splunk 9.4.3 as a docker container from the image registry.hub.docker.com/splunk/splunk:latest.
However, it terminates after approx. 60 seconds with the message:

TASK [splunk_standalone : Get existing HEC token] ******************************
fatal: [localhost]: FAILED! => {
"changed": false
}

MSG:

GET/services/data/inputs/http/splunk_hec_token?output_mode=jsonadmin********8089NoneNoneNone[200, 404];; AND excep_str: URL: https://127.0.0.1:8089/services/data/inputs/http/splunk_hec_token?output_mode=json; data: None, exception: API call for https://127.0.0.1:8089/services/data/inputs/http/splunk_hec_token?output_mode=json and data as None failed with status code 401: {"messages":[{"type": "ERROR", "text": "Unauthorised"}]}, failed with status code 401: {"messages":[{"type": "ERROR", "text": "Unauthorised"}]}

PLAY RECAP *********************************************************************
localhost : ok=69 changed=3 unreachable=0 failed=1 skipped=69 rescued=0 ignored=0

If I start the container with "sleep infinity" and then exec into the container I can start splunk with "splunk start" and splunk works perfectly.
Can anyone tell me what the problem is?

Labels (2)
0 Karma
1 Solution

thahir
Communicator

The error indicates the automation can't authenticate against 127.0.0.1:8089

Accept the license and try with below

docker run -d \
--name splunk \
-e SPLUNK_START_ARGS="--accept-license" \
-e SPLUNK_PASSWORD="yourpassword" \
splunk/splunk:latest

View solution in original post

thahir
Communicator

The error indicates the automation can't authenticate against 127.0.0.1:8089

Accept the license and try with below

docker run -d \
--name splunk \
-e SPLUNK_START_ARGS="--accept-license" \
-e SPLUNK_PASSWORD="yourpassword" \
splunk/splunk:latest

dbloms
Explorer

Yes, you are right.

The admin password was changed, now it it starts without problems.

Many thanks to you, you saved my day!

0 Karma

thahir
Communicator

hi @dbloms ,

Glad to hear.

happy splunking!

P.S.: Karma Points are appreciated by me and the other contributors :slightly_smiling_face: 

 

livehybrid
Ultra Champion

Hi @dbloms 

What env variables and/or configs are you passing through to this container? 

Thanks

Will

dbloms
Explorer

Hello @livehybrid ,

thank you for your support!

I've set the following environment variables:

SPLUNK_START_ARGS: --accept-license
TZ: Europe/Berlin
SPLUNK_PASSWORD: XXXXXXX

I run splunk on a kubernets (k3s)  cluster, so there are many variables managed by k3s.

I've uploaded the output a a failed start to https://bloms.de/download/splunk-failed-start.txt

 

Thank you

Dieter

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...