Heya! I was happy to find an easy way to throw up a local splunk instance via the examples page - thanks.
However, if you use the compose file as is:
version: "3.6"
services:
so1:
image: ${SPLUNK_IMAGE:-splunk/splunk:latest}
container_name: so1
environment:
- SPLUNK_START_ARGS=--accept-license
- SPLUNK_PASSWORD
ports:
- 8000:8000
There's a couple issues:
- most importantly you need to add
- SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com or else it won't start. Thank you for the very helpful error though!! (so1 | For example: docker run -e SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com -e SPLUNK_START_ARGS=--accept-license -e SPLUNK_PASSWORD splunk/splunk). This causes it fatally stop so should be fixed
- you don't need
container_name: so1 - it will use the service name above
- i suggest renaming
so1 to be splunk . I know there's lots more uses of this service name in the example doc, but so1 isn't useful when you do docker ps - especially if you have a couple dozen containers running like i do. Later on you can even rename uf1 to splunk-forwarder. We've got the power to have nice names ...yes!!
version: "3.6" can be removed - docker even complains ``version is obsolete, it will be ignored, please remove it to avoid potential confusion
- make it a happy path and just put a janky default password in there. If you want to get fancy, you can use an
.env file that has a random password in it like these fine docs here do - one copy and paste your secure!
Here's what I ended up with that worked:
services:
splunk:
image: ${SPLUNK_IMAGE:-splunk/splunk:latest}
environment:
- SPLUNK_START_ARGS=--accept-license
- SPLUNK_PASSWORD=${SPLUNK_PASSWORD:-password123}
- SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com
ports:
- 8000:8000
sprinkle these changes through out the whole doc and keep up the good work!
Heya! I was happy to find an easy way to throw up a local splunk instance via the examples page - thanks.
However, if you use the compose file as is:
There's a couple issues:
- SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-comor else it won't start. Thank you for the very helpful error though!! (so1 | For example: docker run -e SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com -e SPLUNK_START_ARGS=--accept-license -e SPLUNK_PASSWORD splunk/splunk). This causes it fatally stop so should be fixedcontainer_name: so1- it will use the service name aboveso1to besplunk. I know there's lots more uses of this service name in the example doc, butso1isn't useful when you dodocker ps- especially if you have a couple dozen containers running like i do. Later on you can even renameuf1tosplunk-forwarder. We've got the power to have nice names ...yes!!version: "3.6"can be removed - docker even complains ``versionis obsolete, it will be ignored, please remove it to avoid potential confusion.envfile that has a random password in it like these fine docs here do - one copy and paste your secure!Here's what I ended up with that worked:
sprinkle these changes through out the whole doc and keep up the good work!