Splunk Observability Cloud

OTEL Collector on legacy RHEL6 machine - How do I overcome mapping these values?

Krzysztof
New Member

Hello working for a client that has some older infra still on Red Hat 6 (to be changed but this is not on my side and could happen far into the future). Kernel 2.6.32 (around that). We need to connect these machines to Splunk Observability Cloud! Managed to overcome installation issues (some cheats here and there) and got RPM installed as you can see. 

 

 

FATAL: kernel too old
...
...
...
/usr/lib/splunk-otel-collector/agent-bundle/bin/patch-interpreter: line 15:  5818 Aborted                 (core dumped) ${tmproot%/}/bin/patchelf --set-

[root@RHEL6 ~]# rpm -q splunk-otel-collector
splunk-otel-collector-0.46.0-1.x86_64

 

 

 But default conf was not created so I copied the same from RHEL7.

 

 

[root@localhost ~]# /usr/bin/otelcol --config /etc/otel/collector/splunk-otel-collector.conf
2022/03/18 06:07:28 main.go:263: Set config to /etc/otel/collector/splunk-otel-collector.conf
2022/03/18 06:07:28 main.go:346: Set ballast to 168 MiB
2022/03/18 06:07:28 main.go:360: Set memory limit to 460 MiB
Error: failed to get config: cannot retrieve the configuration: unable to parse yaml: yaml: unmarshal errors:
  line 1: cannot unmarshal !!str `SPLUNK_...` into map[string]interface {}
2022/03/18 06:07:28 main.go:130: application run finished with error: failed to get config: cannot retrieve the configuration: unable to parse yaml: yaml: unmarshal errors:
  line 1: cannot unmarshal !!str `SPLUNK_...` into map[string]interface {}
[root@localhost ~]#


[root@localhost ~]# go version
go version go1.18 linux/amd64

 

 

so all the files are in place, they look same as the ones on working system, file is read for sure as SPLUNK_ is the first value in the .conf (just proof that all the values, masked here for security of course, are in place).

 

 

[root@localhost ~]# head /etc/otel/collector/splunk-otel-collector.conf
SPLUNK_CONFIG=/etc/otel/collector/agent_config.yaml
SPLUNK_ACCESS_TOKEN=*******
SPLUNK_REALM=us0
<and so on>

 

 

Any ideas how to overcome mapping those values properly? I dont know if other problems will not show in the next steps but I have to try. I know and acknowledge RHEL6 is not supported but the binary looks like launching and I have high hopes. TIA!

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...