setup_logging.sh script failure

[cybergoatpsyops]

During initial setup of the Ubuntu box for Splunk logging, the script fails out. First error is Error: No such object: splunk.

Modifying the script to point to the splunk-compose.yml file full path, the script now downloads the correct docker image for Splunk, but then the scripts hangs on [*] Waiting for splunk.

Troubleshooting Splunk, I used docker compose -f <path to splunk-compose.yml> to investigate what was causing the hang and saw the following fail in the build process:

splunk             | An exception occurred during task execution. To see the full traceback, use -vvv. The error was: IsADirectoryError: [Errno 21] Is a directory: '/opt/splunk/etc/system/local/web.conf'
splunk             | fatal: [localhost]: FAILED! => {
splunk             |     "changed": false,
splunk             |     "rc": 1
splunk             | }
splunk             |
splunk             | MSG:
splunk             |
splunk             | MODULE FAILURE
splunk             | See stdout/stderr for the exact error
splunk             |
splunk             |
splunk             | MODULE_STDERR:
splunk             |
splunk             | Traceback (most recent call last):
splunk             |   File "/var/tmp/ansible-tmp-1663948465.5231454-650-77084492922095/AnsiballZ_ini_file.py", line 102, in <module>splunk             |     _ansiballz_main()
splunk             |   File "/var/tmp/ansible-tmp-1663948465.5231454-650-77084492922095/AnsiballZ_ini_file.py", line 94, in _ansiballz_main
splunk             |     invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
splunk             |   File "/var/tmp/ansible-tmp-1663948465.5231454-650-77084492922095/AnsiballZ_ini_file.py", line 40, in invoke_module
splunk             |     runpy.run_module(mod_name='ansible_collections.community.general.plugins.modules.ini_file', init_globals=None, run_name='__main__', alter_sys=True)
splunk             |   File "/usr/lib/python3.7/runpy.py", line 205, in run_module
splunk             |     return _run_module_code(code, init_globals, run_name, mod_spec)
splunk             |   File "/usr/lib/python3.7/runpy.py", line 96, in _run_module_code
splunk             |     mod_name, mod_spec, pkg_name, script_name)
splunk             |   File "/usr/lib/python3.7/runpy.py", line 85, in _run_code
splunk             |     exec(code, run_globals)
splunk             |   File "/tmp/ansible_ini_file_payload_dmffhxt0/ansible_ini_file_payload.zip/ansible_collections/community/general/plugins/modules/ini_file.py", line 336, in <module>
splunk             |   File "/tmp/ansible_ini_file_payload_dmffhxt0/ansible_ini_file_payload.zip/ansible_collections/community/general/plugins/modules/ini_file.py", line 316, in main
splunk             |   File "/tmp/ansible_ini_file_payload_dmffhxt0/ansible_ini_file_payload.zip/ansible_collections/community/general/plugins/modules/ini_file.py", line 144, in do_ini
splunk             | IsADirectoryError: [Errno 21] Is a directory: '/opt/splunk/etc/system/local/web.conf'

I assume the above is the reason it fails the Splunk health check.

Specs
Ubuntu 22.04.1 LTS (GNU/Linux 5.15.0-48-generic x86_64)
Docker Engine Community 20.10.18
Docker Compose version v2.10.2

[benjaminshell]

I see this was closed in favor of #27. Thanks for bringing this one up.