Cannot detect Splunk version on Docker

[Utano]

Hello,

I'm getting this error message on Splunk Docker (version 7.3.X or 8.0.X) when I try to use Maps+ visualization: Error rendering Maps+ visualization: Unsupported Splunk version detected - Maps+ for Splunk requires Splunk 7.x

When I try to access to REST API (/en-US/splunkd/__raw/servicesNS/nobody/leaflet_maps_app/server/info), I got this error message:

<response>
<messages>
<msg type="ERROR">Application does not exist: leaflet_maps_app</msg>
</messages>
</response>

Is there a specificity with Splunk on Docker?

Environment:

• Splunk on Docker (https://hub.docker.com/r/splunk/splunk/) 7.3.4 and 8.0.2
• Tested with admin user
• Maps+ 3.1.4

Thanks!

[Utano]

Hello,

The issue was due to the archive structure built by GitHub. Archive subdirectory has the name of the archive: "maps-plus-3.1.4":

$ tar -tzvf maps-plus-3.1.4-github.tar.gz
drwxrwxr-x root/root         0 2020-01-29 21:00 maps-plus-3.1.4/
-rw-rw-r-- root/root      1352 2020-01-29 21:00 maps-plus-3.1.4/CHANGELOG.md
-rw-rw-r-- root/root     34527 2020-01-29 21:00 maps-plus-3.1.4/LICENSE.md
-rw-rw-r-- root/root     36050 2020-01-29 21:00 maps-plus-3.1.4/README.md
drwxrwxr-x root/root         0 2020-01-29 21:00 maps-plus-3.1.4/README/
...

So, Splunk application is deployed this name: maps-plus-3.1.4

In Splunk Base, the subdirectory in archive is named "leaflet_maps_app". All references (dashboard, JS) linked to leaflet_maps_app.

I have the issue with installation of Maps+ with Splunk Docker: $ docker run -d -p 8000:8000 -e SPLUNK_START_ARGS=--accept-license -e SPLUNK_PASSWORD=XXX -e SPLUNK_APPS_URL=https://github.com/sghaskell/maps-plus/archive/3.1.4.tar.gz --name splunk splunk/splunk:7.3

The solution is to use the Splunk Base archive with "leaflet_maps_app" subdirectory in archive.