the contents of inputs.conf get reset.

[tt-nexteng]

I am running a Splunk Indexer on Docker in an EC2 instance. I use the following Compose file to start the service. However, every time I restart the EC2 instance, the contents of inputs.conf get reset.

version: "3.6"

networks:
  splunknet:
    driver: bridge
    attachable: true

volumes:
  splunk-var:
    external: true
  splunk-etc:
    external: true

services:
  splunk:
    networks:
      splunknet:
        aliases:
          - splunk
    image: xxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/splunk/splunk:latest
    container_name: splunk
    restart: always
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=password
    ports:
      - "80:8000"
      - "9997:9997"
    volumes:
      - splunk-var:/opt/splunk/var
      - splunk-etc:/opt/splunk/etc

The following is my conf.

[splunktcp-ssl:9997]
disabled = 0

[SSL]
serverCert = /opt/splunk/etc/auth/mycerts/myCombinedServerCertificate.pem
sslPassword = password
requireClientCert = false

[livehybrid · Accepted solution]

Hi @tt-nexteng 

How are you loading your inputs.conf into the Docker image? Are you adding directly into the container once it has started up? Splunk Ansible runs each time the container starts, therefore the container is fairly idempotent and will apply the configuration defined in default.yml / docker-compose ENV variables when started.

Check out https://splunk.github.io/docker-splunk/ADVANCED.html for some configuration options you might want to look at to persist the inputs.conf - Specifically the section around enabling SSL as this has the config for inputs on port 9997 too!
https://splunk.github.io/docker-splunk/ADVANCED.html#:~:text=distributed%2C%20containerized%20enviro...

Sample default.yml snippet to configure Splunk TCP with SSL:

splunk:
  ...
  s2s:
    ca: /mnt/certs/ca.pem
    cert: /mnt/certs/cert.pem
    enable: true
    password: abcd1234
    port: 9997
    ssl: true
  ...

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will