Open djflux opened 1 year ago
Following up - I can use the exact example file and the following command and the so1 container will start but the uf1 container still does not start outputting the same message. This behavior occurs on both Linux and Windows.
Command:
UF_IMAGE=splunk/universalforwarder:9.0.5 SPLUNK_IMAGE=splunk/splunk:9.1.1 SPLUNK_PASSWORD=changeme docker compose up
uf1 | TASK [splunk_common : Enable forwarding to ['so1']] ****************************
uf1 | failed: [localhost] (item=so1) => {
uf1 | "ansible_loop_var": "item",
uf1 | "changed": false,
uf1 | "cmd": [
uf1 | "/opt/splunkforwarder/bin/splunk",
uf1 | "add",
uf1 | "forward-server",
uf1 | "so1:9997",
uf1 | "-auth",
uf1 | "admin:changeme",
uf1 | "--accept-license",
uf1 | "--answer-yes",
uf1 | "--no-prompt"
uf1 | ],
uf1 | "delta": "0:00:00.338556",
uf1 | "end": "2023-09-14 20:42:23.579038",
uf1 | "failed_when_result": true,
uf1 | "item": "so1",
uf1 | "rc": 12,
uf1 | "start": "2023-09-14 20:42:23.240482"
uf1 | }
uf1 |
uf1 | STDOUT:
uf1 |
uf1 | Warning: Attempting to revert the SPLUNK_HOME ownership
uf1 | Warning: Executing "chown -R splunk /opt/splunkforwarder"
uf1 |
uf1 |
uf1 | STDERR:
uf1 |
uf1 | Cannot connect to remote instance.
uf1 |
Did you ever figure this out? I have the same issue right now
The example docker compose file here does properly start any splunk containers using version splunk/splunk:9.1.1 and splunk/universalforwarder:9.0.5:
https://splunk.github.io/docker-splunk/EXAMPLES.html#create-standalone-and-universal-forwarder
Here is my docker-compose.yml:
This is the log message from the uf1 container:
Here is the relevant log message from so1:
I've tried this compose file on Oracle Linux 8.8 as well as Docker Desktop on Windows 10 with the same results.
Here are the docker and rpm versions and the environment on Linux:
Let me know if any more information is needed. Thanks for the help.
Cheers, Andy