Getting Data In

How to skip Splunk license agreement page on Containerise the splunk?

gugan
Engager

I have created a Dockerfile when the container build during that time I need to create multiple login users on backside of Splunk.

I am getting splunk agreement issue able unable to skip/accept agreement on build container.

Dockerfile

FROM splunk/splunk:latest

ENV SPLUNK_HOME /opt/splunk

RUN apt-get update && apt-get install -y wget

COPY ./splunk-launch.conf /opt/splunk/etc/splunk-launch.conf COPY ./splunk.license /opt/splunk/etc/licenses/enterprise/splunk.license

COPY ./My-app1 / /opt/splunk/etc/apps/My-app1 COPY ./My-app2 /opt/splunk/etc/apps/My-app2 COPY ./My-app3 /opt/splunk/etc/apps/My-app3

COPY ./splunk_user.sh /opt/splunk/bin/splunk_user.sh

RUN chmod +x /opt/splunk/bin/splunk_user.sh RUN chown -R splunk:splunk /opt/splunk/bin/splunk_user.sh

EXPOSE 8000/tcp 8089/tcp 8191/tcp 9997/tcp 1514 8088/tcp

VOLUME [ “/opt/splunk/etc”, “/opt/splunk/var” ]

WORKDIR /opt/splunk/bin

CMD [“./splunk_user.sh”]

splunk_user.sh

./splunk add user pradeep -password passwd123 -role admin -email pradeep@gmail.com -full-name Pradeep -auth admin:changeme ./splunk add user sankar -password passwd123 -role admin -email sankar@gmail.com -full-name Sankar -auth admin:changeme

Error

alt text

0 Karma

outcoldman
Communicator

I would highly suggest you on how official image does that, it is open sourced and you can find all the scripts to build the image under https://github.com/splunk/docker-splunk, and specifically the entrypoint.sh file https://github.com/splunk/docker-splunk/blob/master/enterprise/entrypoint.sh

I am not sure if creating users inside the image is a good idea, considering that they are will be stored under /opt/splunk/etc, which will be mapped to some other volume first time you are going to start the image. Also all the default etc files are stored under https://github.com/splunk/docker-splunk/blob/master/enterprise/entrypoint.sh#L21, so if you really wants to put your apps inside the image, you should put them under /var/opt/splunk/etc, so image will place them in the right place when you will try to start the image for the first time. You can actually store also users information here as well.

Also you are overriding default CMD with CMD [“./splunk_user.sh”] which means that you are going to override default entrypoint.sh

0 Karma

harsmarvania57
Ultra Champion

Hi @gugan,

Generally if you want to accept license agreement using CLI when you start splunk first time then command should be $SPLUNK_HOME/bin/splunk start --accept-license, I don't have much more knowledge on Docker so command which I have provided might help you.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...