Splunk Docker and docker-compose ?

chrbar · 12. Juli 2020

Hello,

Does someone has a guide about How-To Splunk Docker and docker-compose?

Thanks you,

Chris

davidh2k · 13. Juli 2020

You can try to use the composerizer:

https://www.composerize.com/

This site translates most (if not all) docker run commands to docker-compose.yml syntax.

Based off https://hub.docker.com/r/splunk/splunk/ the compose file would look like this:

Code

version: '3.3'
services:
  splunk:
    ports:
      - '8000:8000'
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=<password>
    container_name: splunk
    image: 'splunk/splunk:latest'

Greetings

David

tinh_x7 · 16. August 2020

Hi,

I'm trying to test Splunk but I got errors:

Code

Creating splunk ... error

ERROR: for splunk  Cannot start service splunk: OCI runtime create failed: container_linux.go:349: starting container process caused "exec: \"/sbin/entrypoint.sh\": stat /sbin/entrypoint.sh: permission denied": unknown

ERROR: for splunk  Cannot start service splunk: OCI runtime create failed: container_linux.go:349: starting container process caused "exec: \"/sbin/entrypoint.sh\": stat /sbin/entrypoint.sh: permission denied": unknown
ERROR: Encountered errors while bringing up the project.

File permissions:

Code

[root@server splunk]$
total 12
drwxr-xr-x  2 dockeruser users 4096 Aug 15 19:46 .
drwx--x--x 36 root       root  4096 Aug 15 19:46 ..
-rw-r--r--  1 dockeruser users  224 Aug 15 19:44 docker-compose.yml

davidh2k · 18. August 2020

You don't seem to be the only one experiencing that error (no solution provided though):

https://community.splunk.com/t…on-error/m-p/514352#M6555

Greetings

David

Morlan · 18. August 2020

Did you bind-mount any volumes when setting up the container?

tinh_x7 · 18. August 2020

I tried with volumes and without, but error persist.

I end up installed Splunk directly onto OMV.

Morlan · 18. August 2020

Then probably an error in the docker image. You could try a stable version instead of :latest

tinh_x7 · 19. August 2020

I tried a few diff't versions such as 7.3, 7.2, 7.1 8.0, but no luck.

wiinc1 · 4. September 2022

Zitat von tinh_x7

I tried with volumes and without, but error persist.
I end up installed Splunk directly onto OMV.

tinh_x7 - What were the steps you took in order to complete the installation? Thanks.

Splunk Docker and docker-compose ?

chrbar 13. Juli 2020

Jetzt mitmachen!

Tags