×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
samuel-devops
Explorer
Member since: ‎03-05-2025
‎03-09-2025
Community Statistics
Posts 3
Solutions 0
Karma Given 2
Karma Received 2
Member Since ‎03-05-2025
Activity Feed
View All

Re: Splunkforwarder Startup Error in Docker contai...

by in Getting Data In
‎03-07-2025 10:52 PM
‎03-07-2025 10:52 PM
Can you elaborate further, how to enable? ... View more

Re: Splunkforwarder Startup Error in Docker contai...

by in Getting Data In
‎03-07-2025 02:20 AM
1 Karma
‎03-07-2025 02:20 AM
1 Karma
Seems like 9.3.2 version is running fine, but still not able to send logs to splunk server which is running on EC2 instance.. below is my splunkforwarder.yml. Can you help me with this? It seems like forward server and monitor is not setup in the pod with below yml. How should I configure the inputs / outputs.conf files when using splunkforwarder image? I don't see issue from splunk-server. apiVersion: v1 kind: Pod metadata: name: splunk-forwarder spec: containers: - name: splunk image: splunk/universalforwarder:9.3.2 env: - name: SPLUNK_START_ARGS value: "--accept-license" - name: SPLUNK_USER value: "root" - name: SPLUNK_PASSWORD value: "YourSplunkPassword" - name: SPLUNK_ADD value: "monitor /var/logs" - name: SPLUNK_SERVER value: "splunk-server:9997" volumeMounts: - name: log-storage mountPath: /var/logs volumes: - name: log-storage persistentVolumeClaim: claimName: log-pvc ... View more

Splunkforwarder Startup Error in Docker containers

by in Getting Data In
‎03-05-2025 01:38 AM
1 Karma
‎03-05-2025 01:38 AM
1 Karma
  Commands used to run docker image: docker run -d -p 9997:9997 -p 8080:8080 -p 8089:8089 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=test12345" --name uf splunk/universalforwarder:latest Seeing below error when Splunkforwarder image in starting up in docker. 2025-03-05 14:47:58 included: /opt/ansible/roles/splunk_universal_forwarder/tasks/../../../roles/splunk_common/tasks/check_for_required_restarts.yml for localhost 2025-03-05 14:47:58 Wednesday 05 March 2025 09:17:58 +0000 (0:00:00.044) 0:00:30.316 ******* 2025-03-05 14:48:31 FAILED - RETRYING: [localhost]: Check for required restarts (5 retries left). 2025-03-05 14:48:31 FAILED - RETRYING: [localhost]: Check for required restarts (4 retries left). 2025-03-05 14:48:31 FAILED - RETRYING: [localhost]: Check for required restarts (3 retries left). 2025-03-05 14:48:31 FAILED - RETRYING: [localhost]: Check for required restarts (2 retries left). 2025-03-05 14:48:31 FAILED - RETRYING: [localhost]: Check for required restarts (1 retries left). 2025-03-05 14:48:31 2025-03-05 14:48:31 TASK [splunk_universal_forwarder : Check for required restarts] **************** 2025-03-05 14:48:31 fatal: [localhost]: FAILED! => { 2025-03-05 14:48:31 "attempts": 5, 2025-03-05 14:48:31 "changed": false, 2025-03-05 14:48:31 "changed_when_result": "The conditional check 'restart_required.status == 200' failed. The error was: error while evaluating conditional (restart_required.status == 200): 'dict object' has no attribute 'status'. 'dict object' has no attribute 'status'" 2025-03-05 14:48:31 } 2025-03-05 14:48:31 2025-03-05 14:48:31 MSG: 2025-03-05 14:48:31 2025-03-05 14:48:31 GET/services/messages/restart_required?output_mode=jsonadmin********8089NoneNoneNone[200, 404];;; failed with NO RESPONSE and EXCEP_STR as Not supported URL scheme http+unix Splunk.d is running fine, the ports are open as well Tried to curl http://localhost:8089/services/messages/restart_required?output_mode=json ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎03-09-2025 02:48 PM
Karma from
View All
Karma given to
View All