About VincentC

VincentC · ‎09-23-2020

Got around it with docker run -d -p 8000:8000 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=mydummypw" -e "SPLUNK_ROLE=splunk_heavy_forwarder" -e "SPLUNK_BEFORE_START_CMD=edit licenser-groups Forwarder -is_active 1" --name hforwarder splunk/splunk:latest I didn't know this SPLUNK_BEFORE_START_CMD environment variable existed.

VincentC · ‎09-23-2020

I am using the splunk docker image to start a heavy forwarder with this command: docker run -d -p 8000:8000 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=mydummypw" -e "SPLUNK_ROLE=splunk_heavy_forwarder" --name hforwarder splunk/splunk:latest I would like this heavy forwarder to run with the forwarder license, but when I check with splunk list licenser-groups I see that a Trial license is selected instead or the Forwarder one: Enterprise is_active:0 stack_ids: Forwarder is_active:0 stack_ids: forwarder Free is_active:0 stack_ids: free Lite is_active:0 stack_ids: Lite_Free is_active:0 stack_ids: Trial is_active:1 stack_ids: download-trial I could of course connect to the container and switch the license group with splunk edit licenser-groups Forwarder -is_active 1 but this requires a restart and I would like to achieve this with only parameters to the docker run command. Any idea if this is possible ? If I add the SPLUNK_LICENSE_MASTER_URL parameter to make my heavy forwarder a slave to a license server, it works, but I am looking for a way to use the Forwarder license instead.

VincentC · ‎09-05-2020

I thought I had tried that already but indeed it does work with a | fields * at the end of the base search. I'll have a deeper look into this. Thanks a lot

VincentC · ‎09-05-2020

Yes it is. Event types are extracted correctly with inline searches, but not when using a base search.

VincentC · ‎09-05-2020

I have simple log data and I use event types to classify them based on their _raw content: event type loglevel_error, search string "[ERROR] OR CRITICAL", color red event type loglevel_warning, search string "[WARN] OR [WARNING]", color orange The event type is added correctly when my dashboard uses inline searches, but not when i use a base search. As a workaround I have included my event type search strings in my base search with searchmatch. However I no longer have the color coding associated with event types when I display my logs.

VincentC · ‎09-05-2020

I have a dashboard displaying counts on some event types I have created. I tried to optimize by adding a base search to my dashboard but it seems that event types are not available in the results of the base search. Is this expected ? Any workaroud ?

Posts	7
Solutions	1
Karma Given	14
Karma Received	0
Member Since	‎08-15-2020

Online Status	Offline
Date Last Visited	‎03-19-2025 05:10 AM

How to start a splunk container with the forwarder...

event types not available in base search

Re: How to start a splunk container with the forwa...

How to start a splunk container with the forwarder...

Re: event types not available in base search

Re: event types not available in base search

Re: event types not available in base search

event types not available in base search

Are you a member of the Splunk Community?