pass4symkey management in splunk-docker

[henricook]

trafficstars

Hi all,

I'm struggling to find out how to get the current pass4SymKey (decrypted) on my dockerised splunk instance, and in general how to manage it (can I change it with a line in defaults.yaml for example?). Can anyone point me in the right direction?

I tried getting it on a container with: $SPLUNK_HOME/bin/splunk show-decrypted --value '<pass4symkey>'

But just got:

Warning: cannot create "/opt/splunk/var/log/splunk"

Warning: cannot create "/opt/splunk/var/log/introspection"

Warning: cannot create "/opt/splunk/var/log/watchdog"
<pass4symkey>