Looking at the <a href="https://github.com/splunk/splunk-ansible/search?q=set_as_hec_r

My defaults/defaults.yaml <div class="snippet-cli

This was fixed as part of this PR: <a class="issue-link js-issue-link" data-error-text

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

see <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id

SPLUNK_HEC_TOKEN is not supported about docker-splunk HOT 7 CLOSED

splunk commented on June 9, 2024

SPLUNK_HEC_TOKEN is not supported

from docker-splunk.

Comments (7)

arctan5x commented on June 9, 2024 3

This is True. We don't have the standalone hec support now. This can be an easy fix.

from docker-splunk.

lephino commented on June 9, 2024 1

Just had another request for this feature through email, we'll get it added.

from docker-splunk.

outcoldman commented on June 9, 2024

My defaults/defaults.yaml

---
retry_num: 50
splunk:
  app_paths:
    default: /opt/splunk/etc/apps
    httpinput: /opt/splunk/etc/apps/splunk_httpinput
    idxc: /opt/splunk/etc/master-apps
    shc: /opt/splunk/etc/shcluster/apps
  exec: /opt/splunk/bin/splunk
  group: splunk
  hec_disabled: 0
  hec_enableSSL: 1
  hec_port: 8088
  hec_token: 9705367d-c294-4c84-b683-327279a23a19
  home: /opt/splunk
  http_port: 8000
  idxc:
    enable: false
    label: idxc_label
    replication_factor: 3
    replication_port: 4001
    search_factor: 3
    secret: lcC+1uges+rIrlEIGDDd0MidOC7MvytL
  opt: /opt
  password: Pc4D4CC4L58S5kQ8tH0MMnpwFjIdP1i/
  pid: /opt/splunk/var/run/splunk/splunkd.pid
  s2s_port: 9997
  shc:
    enable: false
    label: shc_label
    replication_factor: 3
    replication_port: 4001
    secret: mwV+hNdrayEA3dYiyZOfZsFGjV2Acnwx
  svc_port: 8089
  user: splunk

And docker-compose.yml

version: "3.7"

services:

  splunk:
    environment:
      - SPLUNK_ENABLE_LISTEN=9997
      - SPLUNK_START_ARGS=--accept-license --no-prompt --answer-yes
      - SPLUNK_USERNAME=admin
      - SPLUNK_PASSWORD=password
      - SPLUNK_HEC_TOKEN=57969BB7-DFE9-47A3-8EA3-4A566027487C
    hostname: splunk
    image: splunk/splunk:7.2.0
    ports:
      - "10000:8000"
      - "9088:8088"
      - "10997:9997"
    restart: always
    volumes:
      - ./defaults:/tmp/defaults

from docker-splunk.

nwang92 commented on June 9, 2024

This was fixed as part of this PR: splunk/splunk-ansible#9. It should be available when we push a new image. Going to close this for now.

from docker-splunk.

bb03 commented on June 9, 2024

@nwang92 Fixed this in the splunk-ansible branch -- https://github.com/splunk/splunk-ansible/blob/master/roles/splunk_standalone/tasks/main.yml. Just verified that his fix works for this issue. Although I did it through the /tmp/defaults/default.yml folder and not through the args passed in on the docker-compose file.

from docker-splunk.