ERROR: Couldn't read "/opt/splunk/etc/splunk-launch.conf" -- maybe $SPLUNK_HOME or $SPLUNK_ETC is set wrong?

[Tuumke]

Running this image on unRAID with defaults (accept for the location of the docker files, i dont use appdata).

*** Running /etc/rc.local...
ERROR: Couldn't read "/opt/splunk/etc/splunk-launch.conf" -- maybe $SPLUNK_HOME or $SPLUNK_ETC is set wrong?

*** Booting runit daemon...
*** Runit started as PID 9
Jul 16 09:00:51 8f6789d7cb80 syslog-ng[15]: syslog-ng starting up; version='3.5.3'

And i cant open the webui on port 9000

[DracusMage]

I have the same problem. Creating an empty config file ("touch splunk-launch.conf") inside the console at the correct path causes the message to switch to:

This appears to be your first time running this version of Splunk.
Could not open version file "/opt/splunk/etc/splunk.version" (2).

"Touching" splunk.version then moves it onto a different set of messages. Here is the full startup readout:

*** Running /etc/rc.local...

This appears to be your first time running this version of Splunk.
WARNING: Short read from '/opt/splunk/etc/splunk.version'.

Splunk software must create an administrator account during startup. Otherwise, you cannot log in.
Create credentials for the administrator account.
Characters do not appear on the screen when you type in credentials.
tcgetattr: Inappropriate ioctl for device
WARNING: error changing terminal modes - password will echo!

Please enter an administrator username:
*** Booting runit daemon...
*** Runit started as PID 8
Jul 18 13:52:24 7b7a06e76e35 syslog-ng[14]: syslog-ng starting up; version='3.5.3'
Jul 18 13:52:24 7b7a06e76e35 /usr/sbin/cron[12]: (CRON) INFO (pidfile fd = 3)
Jul 18 13:52:24 7b7a06e76e35 /usr/sbin/cron[12]: (CRON) INFO (Skipping @reboot jobs -- not system startup)

It seems the only way around this is to run Splunk on another system in order to get a working setup to copy over to the docker's settings, or to pass an Administrator login and password on initial startup of the Docker, which is definitely beyond me.

[livehifi]

I have the same issue. Anyone have ideas on how to pass the admin account creation portion? I really want to have Splunk :P

[skirven4]

I think I see the issue here. I'll have to poke around on this, but from looking at the dockerfile, the install is getting unzipped, then the mounts for the persistent storage are getting mounted. So basically, /opt/splunk/etc is getting built with files on the main docker image, then the mount for /opt/splunk/etc is causing the files to be hidden.

So I think the solution would be:

1. Download the archive from Splunk
2. Unzip the archive
3. Stash the /opt/splunk/var and etc folders to /tmp
4. Mount the storage
5. Run a shell script to copy back the stashed folders and start Splunk.

-Stephen

[skirven4]

I was able to get it working with this docker template, using the official docker image from Splunk. :)

unraidSplunk.txt

[rekonnected]

Bit of a long revival of this issue, but I can confirm the recommendation of @skirven4's template changes, which amount to these important sections:

Image: splunk/splunk

Variable: SPLUNK_START_ARGS
Value: --accept-license

Variable: SPLUNK_PASSWORD
Value: splunk/splunk

Everything else was unchanged, these three changes allow the container to start normally.