docker run failed with runtime configuration

[baby3873575]

Hi, just follow the documentation listing in https://splunk.github.io/docker-splunk/ADVANCED.html#runtime-configuration

docker run --rm -it splunk/splunk:latest create-defaults > default.yml

then

docker run -d -p 8000:8000 -v default.yml:/tmp/defaults/default.yml -e SPLUNK_START_ARGS=--accept-license -e SPLUNK_PASSWORD= splunk/splunk:latest

Will generate

PLAY [Run default Splunk provisioning] *****************************************
Saturday 29 February 2020 19:06:03 +0000 (0:00:00.146) 0:00:00.146 *****

TASK [Gathering Facts] *********************************************************
ok: [localhost]
Saturday 29 February 2020 19:06:05 +0000 (0:00:01.298) 0:00:01.444 *****
Saturday 29 February 2020 19:06:05 +0000 (0:00:00.041) 0:00:01.486 *****
Saturday 29 February 2020 19:06:05 +0000 (0:00:00.041) 0:00:01.527 *****
Saturday 29 February 2020 19:06:05 +0000 (0:00:00.042) 0:00:01.570 *****

TASK [Check all instances for required restarts] *******************************
fatal: [localhost]: FAILED! => {}

MSG:

The field 'become_user' has an invalid value, which includes an undefined variable. The error was: 'splunk' is undefined

PLAY RECAP *********************************************************************
localhost : ok=1 changed=0 unreachable=0 failed=1 skipped=3 rescued=0 ignored=0

[edumserrano]

I understand that this issue is closed but I faced the same issue and it still took me some time to find the solution so I'm leaving it here in hopes it helps others.

The issue is that the paths used when doing the volume mount must be absolute or else it gets mounted as a directory. See Differences between -v and --mount behavior:
"If you use -v or --volume to bind-mount a file or directory that does not yet exist on the Docker host, -v creates the endpoint for you. It is always created as a directory."

That "quirk" of the -v option causes an error message that you can pick up on the container's logs before the error message you linked. You can see:

...
File "/opt/ansible/inventory/environ.py", line 529, in mergeDefaultsFromFile
with open(file, "r") as f: IOError: [Errno 21] Is a directory: '/tmp/defaults/default.yml'
...

That was actually the hint that lead me to figuring out what the real problem was. I guess more experienced docker users won't fall into this error.

So either pass the full path to the default.yml file or for instance if you're running the docker command from the directory where the default.yml file is you could do:

docker run -d -p 8000:8000 -p 8088:8088 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=master123!" -v "$(pwd)/default.yml:/tmp/defaults/default.yml" splunk/splunk:latest

I advise you to use the --mount instead of -v as it's also advised by Docker's documentation Choose the -v or --mount flag. So the above example command would look like:

docker run -d -p 8000:8000 -p 8088:8088 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=master123!" --mount type=bind,source="$(pwd)"/default.yml,target=/tmp/defaults/default.yml splunk/splunk:latest

Finally notice that you don't need to use the default.yml created by docker run --rm -it splunk/splunk:latest create-defaults. You just need the extra configuration you want to add. For instance if you wanted to start splunk with an index named test you could have a default.yml config such as:

---
splunk:
  conf:
    - key: indexes
      value:
        directory: /opt/splunk/etc/system/local
        content:
          test:
            homePath: $SPLUNK_DB/test/db
            coldPath: $SPLUNK_DB/test/colddb
            thawedPath: $SPLUNK_DB/test/thaweddb