Hello, I start splunk 9.4.3 as a docker container from the image registry.hub.docker.com/splunk/splunk:latest. However, it terminates after approx. 60 seconds with the message: TASK [splunk_standalone : Get existing HEC token] ******************************
fatal: [localhost]: FAILED! => {
"changed": false
}
MSG:
GET/services/data/inputs/http/splunk_hec_token?output_mode=jsonadmin********8089NoneNoneNone[200, 404];; AND excep_str: URL: https://127.0.0.1:8089/services/data/inputs/http/splunk_hec_token?output_mode=json; data: None, exception: API call for https://127.0.0.1:8089/services/data/inputs/http/splunk_hec_token?output_mode=json and data as None failed with status code 401: {"messages":[{"type": "ERROR", "text": "Unauthorised"}]}, failed with status code 401: {"messages":[{"type": "ERROR", "text": "Unauthorised"}]}
PLAY RECAP *********************************************************************
localhost : ok=69 changed=3 unreachable=0 failed=1 skipped=69 rescued=0 ignored=0 If I start the container with "sleep infinity" and then exec into the container I can start splunk with "splunk start" and splunk works perfectly. Can anyone tell me what the problem is?
... View more