I'm having an issue with dockerized splunk post 8.1.3 free. The timezone in the web interface remains as UTC. With 8.1.3, I could get around the timezone issue by running:
docker exec -ti splunk sudo microdnf -y --nodocs update tzdata on startup of the container
Post 8.1.3, the time within the container remains as UTC, even with tzdata installed. Is this expected behaviour?
Sample from the docker compose that brings up splunk:
Docker compose:
splunk:
container_name: splunk
image: splunk/splunk:latest
#image: splunk/splunk:8.1.3
environment:
- TZ=America/Toronto
#- TZ=Canada/Eastern
With 8.1.3
Pulling splunk (splunk/splunk:8.1.3)...
8.1.3: Pulling from splunk/splunk
Digest: sha256:fd7dfb17323ee093ca36b71befa71e5074f8a6dc592475407927a0d443022a03
Status: Downloaded newer image for splunk/splunk:8.1.3
date
Wed Jun 2 17:19:41 EDT 2021
With Latest:
latest: Pulling from splunk/splunk
date
Wed Jun 2 21:36:34 America 2021
Does anyone have any suggestions of things I could try?
Thanks
-Jeff
Figured out the issue.
Was able to fix it with:
docker exec -ti splunk sudo microdnf -y --nodocs reinstall tzdata
rather than the original:
docker exec -ti splunk sudo microdnf -y --nodocs update tzdata
Not sure why the docker image acts differently, especially since the Linux version used is the same between 8.1.3 and >8.1.3
Figured out the issue.
Was able to fix it with:
docker exec -ti splunk sudo microdnf -y --nodocs reinstall tzdata
rather than the original:
docker exec -ti splunk sudo microdnf -y --nodocs update tzdata
Not sure why the docker image acts differently, especially since the Linux version used is the same between 8.1.3 and >8.1.3