Getting Data In

running splunk with docker - ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment

sarit_s
Communicator

hello
I was testing Docker as an easy solution to roam Splunk. I have encounter an issue and need your help.

Here are the steps I took:

  1. Created a fresh Splunk container using an official article: https://docs.splunk.com/Documentation/Splunk/7.2.4/Installation/DeployandrunSplunkEnterpriseinsideDo...
  2. I have connect to the Splunk app through the web and uploaded a csv to have some data
  3. I have stopped the container and created an image
  4. I have moved the image and run it on another host

On the other host I receive the below error messages.

fatal: [localhost]: FAILED! =>
{"changed": false, "cmd":
["/opt/splunk/bin/splunk",
"hash-passwd", "Xpktbe!23"], "delta":
"0:00:00.314896", "end": "2019-03-27
09:56:43.305836", "msg": "non-zero
return code", "rc": 8, "start":
"2019-03-27 09:56:42.990940",
"stderr": "", "stderr_lines": [],
"stdout": "ERROR: Couldn't determine
$SPLUNK_HOME or $SPLUNK_ETC; perhaps
one should be set in environment",
"stdout_lines": ["ERROR: Couldn't
determine $SPLUNK_HOME or $SPLUNK_ETC;
perhaps one should be set in
environment"]}
to retry, use: --limit @/opt/container_artifact/ansible-retry/site.retry
PLAY RECAP
********************************************************************* localhost : ok=18

changed=1 unreachable=0 failed=1

ERROR: Couldn't read
"/opt/splunk/etc/splunk-launch.conf"
-- maybe $SPLUNK_HOME or $SPLUNK_ETC is set wrong?

can someone help ?
thanks

0 Karma
1 Solution

frmercier
Engager

I had the same error due to SELinux enabled. Disabling it (/etc/selinux/config SELINUX=disabled) solve my problem.

View solution in original post

0 Karma

ephemeric
Contributor

Check your SELinux log:

 

grep "denied" /var/log/audit/audit.log

 

 

Enable SELinux perms for your bind mount:

 

docker run -d -p 8000:8000 -e SPLUNK_START_ARGS='--accept-license' -e SPLUNK_PASSWORD='<password>' -v /opt/splunk:/opt/splunk:Z splunk/splunk:latest

 

 

https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label

"The Z option indicates that the bind mount content is private and unshared."

 

0 Karma

frmercier
Engager

I had the same error due to SELinux enabled. Disabling it (/etc/selinux/config SELINUX=disabled) solve my problem.

0 Karma

sarit_s
Communicator

any idea ?

0 Karma

mattymo
Splunk Employee
Splunk Employee

Hi! Usually this comes down to the volume mounts missing or needing to be updated. Can you share your swarm file?

- MattyMo
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...