Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Splunk Universal Forwarder on Docker is broken for version 9.2 #839

Open
JtMotoX opened this issue May 25, 2024 · 2 comments
Open

Splunk Universal Forwarder on Docker is broken for version 9.2 #839

JtMotoX opened this issue May 25, 2024 · 2 comments

Comments

@JtMotoX
Copy link

JtMotoX commented May 25, 2024

8.x Works

  1. Remove an existing volume data
    1. sudo rm -rf splunkuf
  2. Start the universal forwarder
    1. docker run --rm -it -v "$(pwd)/splunkuf/opt/etc:/opt/splunkforwarder/etc" -v "$(pwd)/splunkuf/opt/var:/opt/splunkforwarder/var" -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=changeme1" splunk/universalforwarder:8.2
  3. Once started successfully, CTRL+C to stop the container
  4. Start the universal forwarder again with the same command as before
    1. docker run --rm -it -v "$(pwd)/splunkuf/opt/etc:/opt/splunkforwarder/etc" -v "$(pwd)/splunkuf/opt/var:/opt/splunkforwarder/var" -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=changeme1" splunk/universalforwarder:8.2

It works!

9.2 Broken

Perform all the same steps above but use the 9.2 tag. When you try to start it up again the 2nd time (step 4), it will fail with this error:

TASK [splunk_universal_forwarder : Setup global HEC] *********************************************************************************************************************************
fatal: [localhost]: FAILED! => {
    "changed": false
}

MSG:

POST/services/data/inputs/http/httpadmin********8089{'disabled': '0', 'enableSSL': '1', 'port': '8088', 'serverCert': '', 'sslPassword': ''}NoneNoneNone;;; AND excep_str: No Exception, failed with status code 404: {"text":"The requested URL was not found on this server.","code":404}
@yaroslav-nakonechnikov
Copy link

9.3 is here. is it same?

@JtMotoX
Copy link
Author

JtMotoX commented Sep 12, 2024

9.3 is here. is it same?

I just tested 9.3 and I am getting the same error, so yes, still broken.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants