From d6047a95afc0d9f5655c1a13af92150fb1d1f1bc Mon Sep 17 00:00:00 2001 From: Brent Boe Date: Mon, 11 Nov 2019 13:00:14 -0800 Subject: [PATCH 1/2] Fixing the APP_INSTALL page per docker-splunk/issues/210 --- docs/advanced/APP_INSTALL.md | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) diff --git a/docs/advanced/APP_INSTALL.md b/docs/advanced/APP_INSTALL.md index 9232abca..60a25c80 100644 --- a/docs/advanced/APP_INSTALL.md +++ b/docs/advanced/APP_INSTALL.md @@ -9,7 +9,7 @@ App installation can be done a variety of ways: either through a file/directory * [Volume-mount app directory](#volume-mount-app-directory) * [Download via URL](#download-via-url) -* [Multiple apps](@multiple-apps) +* [Multiple apps](#multiple-apps) * [Apps in distributed environments](#apps-in-distributed-environments) ## Volume-mount app directory @@ -34,7 +34,6 @@ In most cases, you're likely hosting the app as a tar file somewhere accessible #### SplunkBase apps Please refer to this docker-compose.yml file for how to download SplunkBase apps with authentication: -
docker-compose.yml

``` version: "3.6" @@ -52,11 +51,9 @@ services: ports: - 8000 ``` -

#### Self-hosted apps Please refer to this docker-compose.yml file for how to download any app hosted at an arbitrary location: -
docker-compose.yml

``` version: "3.6" @@ -72,13 +69,11 @@ services: ports: - 8000 ``` -

#### Apps on filesystem If you build your own image on top of the `splunk/splunk` or `splunk/universalforwarder` image, it's possible you may embedd a tar file of an app inside. Or, you can go with the bind-mount volume approach and inject a tar file on container run time. In either case, it's still possible to install an app from this file on the container's filesystem with the following. Please refer to this docker-compose.yml file for how to install an app in the container's filesystem: -
docker-compose.yml

``` version: "3.6" @@ -94,13 +89,11 @@ services: ports: - 8000 ``` -

## Multiple apps As one would expect, Splunk can and should support downloading any combination or series of apps. This can be incredibly useful when cross-referencing data from various sources. The `SPLUNK_APPS_URL` supports multiple apps, as long as they are comma-separated. Plase refer to this docker-compose.yml file for how to install multiple apps: -
docker-compose.yml

``` version: "3.6" @@ -118,15 +111,12 @@ services: ports: - 8000 ``` -

## Apps in distributed environments This docker image also deploys apps when running Splunk in distributed environments. There are, however, special cases and instructions for how apps get deployed in these scenarios. In the case of multiple search heads (no clustering) and multiple indexers (no clustering), you will explicitly need to tell each container what apps to install by defining a `SPLUNK_APPS_URL` for each role. See the example below and note the different apps used for search heads and indexers: -
2idx2sh.yml

- ``` version: "3.6" @@ -212,11 +202,9 @@ services: ports: - 8000 ``` -

In the case of search head clusters, you will explicitly need to tell the `splunk_deployer` what apps to install by defining a `SPLUNK_APPS_URL` for that particular role. The deployer will manage the distribution of apps to each of the search head cluster members (search heads). See the example below and note the different apps used for search heads and indexers: -
1dep3sh2idx.yml

``` version: "3.6" @@ -342,12 +330,9 @@ services: ports: - 8000 ``` -

In the case of indexer clusters, you will explicitly need to tell the `splunk_cluster_master` what apps to install by defining a `SPLUNK_APPS_URL` for that particular role. The cluster master will manage the distribution of apps to each of the indexer cluster members (indexers). See the example below and note the different apps used for search heads and indexers: -
3idx1sh1cm.yml

- ``` version: "3.6" @@ -453,4 +438,3 @@ services: ports: - 8000 ``` -

From 44ee75c8a3f4b8b8b59d66fb95b94e6094538e58 Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Mon, 18 Nov 2019 14:20:07 -0800 Subject: [PATCH 2/2] Removing extraneous x character --- docs/advanced/APP_INSTALL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/advanced/APP_INSTALL.md b/docs/advanced/APP_INSTALL.md index 91901730..bd149009 100644 --- a/docs/advanced/APP_INSTALL.md +++ b/docs/advanced/APP_INSTALL.md @@ -27,7 +27,7 @@ We can bind-mount this upon container start and use it as a regular Splunk app: $ docker run -it -v ./splunk_app_example:/opt/splunk/etc/apps/splunk_app_example/ --name so1 --hostname so1 -p 8000:8000 -e "SPLUNK_PASSWORD=" -e "SPLUNK_START_ARGS=--accept-license" -it splunk/splunk:latest ``` -You should be able to view the `splunk_app_example` in SplunkWeb after the container successfully finished provisioning.x +You should be able to view the `splunk_app_example` in SplunkWeb after the container successfully finished provisioning. ## Download via URL In most cases, you're likely hosting the app as a tar file somewhere accessible in your network. This decouples the need for Splunk apps and configuration files to exist locally on a node, which enables Splunk to run in a container orchestration environment.