splunk/docker-splunk-legacy

[question] Reconcile the .deb package install scripts and the docker file?

lsb opened this issue · 1 comments

lsb commented

Hello, I'm moving from running the Splunk forwarder from an installed debian package to running in a container. We have configured the forwarder to monitor various files on disk, I am planning to mount those directories in my container, and I was wondering about the following discrepancy.

I see the Splunk .deb postinst script (from the Splunk forwarder 6.3.3) has something like

if [ ! -f "$SPLUNK_HOME/etc/splunk-launch.conf" ] ; then
    sed "s%# SPLUNK_HOME=.*%SPLUNK_HOME=$SPLUNK_HOME%g" "$SPLUNK_HOME/etc/splunk-launch.conf.default" > "$SPLUNK_HOME/etc/splunk-launch.conf"
fi

We aren't explicitly configuring the splunk-launch.conf, and the default suits our needs after we drop a few files in /etc/system/local/. This splunk-launch.conf isn't in the Dockerfile, and now I'm worried that I'm missing configuring a few other steps and environment variables.

How would you best approach this? Thanks.

@lsb I don't think that there are should be any issues with this file. This script only sets SPLUNK_HOME, which might be unset and should work fine (this is from default file)

# Modify the following line to suit the location of your Splunk install.
# If unset, Splunk will use the parent of the directory this configuration
# file was found in