I'm running universalforwarder as a service in docker, here is my docker-compose config: services: services:
splunkuniversalforwarder:
platform: "linux/amd64"
hostname: splunkuniversalforwarder
image: splunk/universalforwarder:latest
volumes:
- opt-splunk-etc:/opt/splunk/etc
- opt-splunk-var:/opt/splunk/var
- ./splunk/splunkclouduf.spl:/tmp/splunkclouduf.spl
ports:
- "8000:8000"
- "9997:9997"
- "8088:8088"
- "1514:1514"
environment:
- SPLUNK_START_ARGS=--accept-license
- SPLUNK_USER=root
- SPLUNK_ENABLE_LISTEN=9997
- SPLUNK_CMD="/opt/splunkforwarder/bin/splunk install app /tmp/splunkclouduf.spl"
- DEBUG=true
- SPLUNK_PASSWORD=<root password>
- SPLUNK_HEC_TOKEN=<HEC token>
- SPLUNK_HEC_SSL=false I have a HTTP Event Collector configured in my Splunk Free Trial account. When running docker-compose a lot of things seem to be going well and then i hit this: TASK [splunk_universal_forwarder : Setup global HEC] ***************************
fatal: [localhost]: FAILED! => {
"changed": false
}
MSG: POST/services/data/inputs/http/httpadmin********8089{'disabled': '0', 'enableSSL': '0', 'port': '8088', 'serverCert': '', 'sslPassword': ''}NoneNoneNone;;; AND excep_str: No Exception, failed with status code 404: {"text":"The requested URL was not found on this server.","code":404} I can see no reference to POST/services/data/inputs/http/httpadmin in any Splunk docs 😞 Can anyone shed any light on this please?
... View more