docker-splunk icon indicating copy to clipboard operation
docker-splunk copied to clipboard

Conf setting is duplicating configuration

Open dp-42 opened this issue 2 years ago • 1 comments
trafficstars

Issue

When you want to set a configuration using the default.yml - configuration-files option the resulting Splunk configuration is broken as options are duplicated:

[kvstore]
storageEngine = wiredTiger
storageEngine

Splunk image: splunk/splunk:9.0.5@sha256:aa74f1f9dbe37eb8710ad79bd5c0ce5229b236c737a8a3aa4143dc9c4023ae7f

Replication:

  1. Spawn a Splunk with a config setting in the default.yml - here is an example:
splunk:
  conf:
    - key: server
      value:
        directory: /opt/splunk/etc/system/local
        content:
          kvstore:
            storageEngine: wiredTiger
  1. Start the Splunk container
  2. Check the /opt/splunk/etc/system/local/server.conf file - everything should be fine
  3. Stop container
  4. Start container
  5. Check the /opt/splunk/etc/system/local/server.conf file - now you will see duplicated and empty keys without values

Debugging

I tried to figure out why this happens - IMHO this seems to be a bug in the shipped Ansible/ini_file module. I use this setting quite frequently and never had any issue with this in the older releases.

In addition I noticed that this is only possible because the allow_no_value was explicitly for false to true - see set_config_stanza.yml#L21. I am not sure why this was done as I cannot think of any Splunk configuration that would utilize this option.

Can you please have a look? If you need further information just let me know!

dp-42 avatar Jun 06 '23 14:06 dp-42

https://github.com/splunk/splunk-ansible/issues/751

yaroslav-nakonechnikov avatar Aug 18 '23 11:08 yaroslav-nakonechnikov