You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/STORAGE_OPTIONS.md
+18-18Lines changed: 18 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,8 @@
1
1
## Data Storage ##
2
-
This section will cover examples of different options for configuring data persistence. This includes both indexed data and configuration items. Splunk only supports data persistence to volumes mounted outside of the container. Data persistence for folders inside of the container is not supported. The following are intended as only as examples and unofficial guidelines.
2
+
This section will cover examples of different options for configuring data persistence. This includes both indexed data and configuration items. Splunk only supports data persistence to volumes mounted outside of the container. Data persistence for folders inside of the container is not supported. The following are intended only as examples and unofficial guidelines.
3
3
4
4
### Storing indexes and search artifacts ###
5
-
Splunk Enterprise, by default, Splunk Enterprise uses the var directory for indexes, search artifacts, etc. In the public image, the Splunk Enterprise home directory is /opt/splunk, and the indexes are configured to run under var/. If you want to persist the indexed data, then mount an external directory into the container under this folder.
5
+
By default, Splunk Enterprise uses the var directory for indexes, search artifacts, etc. In the public image, the Splunk Enterprise home directory is /opt/splunk, and the indexes are configured to run under var/. If you want to persist the indexed data, then mount an external directory into the container under this folder.
6
6
7
7
If you do not want to modify or persist any configuration changes made outside of what has been defined in the docker image file, then use the following steps for your service.
8
8
@@ -13,10 +13,10 @@ docker volume create so1-var
13
13
```
14
14
See Docker's official documentation for more complete instructions and additional options.
15
15
16
-
#### Step 2: Define the dockercompose YAML and start the service####
16
+
#### Step 2: Define the docker-compose YAML and start the service####
17
17
Using the Docker Compose format, save the following contents into a docker-compose.yml file:
18
18
19
-
```
19
+
```yaml
20
20
version: "3.6"
21
21
22
22
networks:
@@ -46,7 +46,7 @@ services:
46
46
- so1-var:/opt/splunk/var
47
47
```
48
48
49
-
This mounts only the contents of /opt/splunk/var, so anything outside of this folder will not persist. Any configuration changes will not remain when the container exits. Note that changes will persist between starting and stopping a container. See the Docker documentation for more discussion on the difference between starting, stopping, and exiting if the difference between them is unclear.
49
+
This mounts only the contents of /opt/splunk/var, so anything outside this folder will not persist. Any configuration changes will not remain when the container exits. Note that changes will persist between starting and stopping a container. See the Docker documentation for more discussion on the difference between starting, stopping, and exiting if the difference between them is unclear.
50
50
51
51
In the same directory as `docker-compose.yml`, run the following command to start the service.
52
52
```
@@ -61,21 +61,21 @@ docker volume inspect so1-var
61
61
The output of that command should list where the data is stored.
62
62
63
63
### Storing indexes, search artifacts, and configuration changes ###
64
-
In this section, we build off of the previous example to save the configuration as well. This can make it easier to save modified configurations, but simultaneously allows configuration drift to occur. If you want to keep configuration drift from happening, but still want to be able to persist some of the data, you can save off the specific "local" folders that you want the data to be persisted for (such as etc/system/local). However, be careful when doing this because you will both know what folders you need to save off and the number of volumes can proliferate rapidly - depending on the deployment. Please take the "Administrating Splunk" through Splunk Education prior to attempting this configuration.
64
+
In this section, we build off of the previous example to save the configuration as well. This can make it easier to save modified configurations, but simultaneously allows configuration drift to occur. If you want to keep configuration drift from happening, but still want to persist some of the data, you can save off the specific "local" folders that you want the data to be persisted for (such as etc/system/local). However, be careful when doing this because you will both know what folders you need to save off and the number of volumes can increase rapidly - depending on the deployment. Please take the "Administrating Splunk" through Splunk Education before attempting this configuration.
65
65
66
-
In these examples, we will assume that the entire etc folder is being mounted into the container.
66
+
We will assume that the entire /etc folder is being mounted into the container in these examples.
67
67
68
68
#### Step 1: Create a named volume ####
69
69
Again, create a simple named volume in your Docker environment, run the following command
70
-
```
70
+
```shell
71
71
docker volume create so1-etc
72
72
```
73
73
See Docker's official documentation for more complete instructions and additional options.
74
74
75
75
#### Step 2: Define the Docker Compose YAML ####
76
76
Notice that this differs from the previous example by adding in the so1-etc volume references. In the following example, save the following data into a file named `docker-compose.yml`.
77
77
78
-
```
78
+
```yaml
79
79
version: "3.6"
80
80
81
81
networks:
@@ -104,19 +104,19 @@ services:
104
104
- 8089
105
105
volumes:
106
106
- so1-var:/opt/splunk/var
107
-
- so1-etc:/opt/splunk/etc
107
+
- so1-etc:/opt/splunk/etc
108
108
```
109
109
110
110
In the same directory as `docker-compose.yml`, run the following command to start the service:
111
-
```
111
+
```shell
112
112
docker-compose up
113
113
```
114
114
115
-
When the volume is mounted the data will persist after the container exits. If a container has exited and restarted, but no data shows up, then check the volume definition and verify that the container did not create a new volume or that the volume mounted is in the same location.
115
+
When the volume is mounted, the data will persist after the container exits. If a container has exited and restarted, but no data shows up, check the volume definition and verify that the container did not create a new volume or that the volume mounted is in the same location.
116
116
117
117
#### Viewing the contents of the volume ####
118
-
To view the etc directory outside of the container run one or both of the commands
119
-
```
118
+
To view the /etc directory outside of the container, run one or both of the commands
119
+
```shell
120
120
docker volume inspect so1-etc
121
121
```
122
122
The output of that command should list the directory associated with the volume mount.
@@ -135,7 +135,7 @@ In the same yaml file you initially used to deploy Splunk instances, update the
135
135
136
136
Below is an example yaml with `SPLUNK_UPGRADE=true`:
137
137
138
-
```
138
+
```yaml
139
139
version: "3.6"
140
140
141
141
networks:
@@ -165,13 +165,13 @@ services:
165
165
- 8089
166
166
volumes:
167
167
- so1-var:/opt/splunk/var
168
-
- so1-etc:/opt/splunk/etc
168
+
- so1-etc:/opt/splunk/etc
169
169
```
170
170
171
171
#### Step 3: Deploy your containers using the updated yaml ####
172
-
Similar to how you initially deployed your containers, run the command with the updated yaml that contains a reference to the new image and SPLUNK_UPGRADE=true in the environment. Make sure that you do NOT destroy previously existing network and volumes. After running the command with the yaml file, your containers should be recreated with the new version of Splunk and persisted data properly mounted to /opt/splunk/var and /opt/splunk/etc.
172
+
Like how you initially deployed your containers, run the command with the updated yaml containing a reference to the new image and SPLUNK_UPGRADE=true in the environment. Make sure that you do NOT destroy previously existing networks and volumes. After running the command with the yaml file, your containers should be recreated with the new version of Splunk and persisted data properly mounted to /opt/splunk/var and /opt/splunk/etc.
173
173
174
174
#### Different types of volumes ####
175
-
Using named volume is recommended so it is easier to attach and detach volumes to different Splunk instances while persisting your data. If you use anonymous volumes, Docker gives them random and unique names so you can still reuse anonymous volumes on different containers. If you use bind mounts, make sure that the mounts are setup properly to persist /opt/splunk/var and opt/splunk/etc. Starting new containers without proper mounts will result in a loss of your data.
175
+
Using named volume is recommended because it is easier to attach and detach volumes to different Splunk instances while persisting your data. If you use anonymous volumes, Docker gives them random and unique names so you can still reuse anonymous volumes on other containers. If you use bind mounts, make sure that the mounts are set up correctly to persist /opt/splunk/var and opt/splunk/etc. Starting new containers without proper mounts will result in a loss of your data.
176
176
177
177
See [Create and manage volumes](https://docs.docker.com/storage/volumes/#create-and-manage-volumes) in the Docker documentation for more information.
0 commit comments