Skip to content
This repository has been archived by the owner on Oct 4, 2024. It is now read-only.

quickstart template deployment fails on Splunk 8.2.0 #42

Open
diwakarj opened this issue May 20, 2021 · 2 comments
Open

quickstart template deployment fails on Splunk 8.2.0 #42

diwakarj opened this issue May 20, 2021 · 2 comments

Comments

@diwakarj
Copy link

diwakarj commented May 20, 2021

Hello,
I'm trying to deploy quickstart template in a new VPC following this steps mentioned here in us-east-1 and i selected c5.4xlarge instance for Splunk launch on EC2.
https://aws-quickstart.s3.amazonaws.com/quickstart-splunk-enterprise/doc/splunk-enterprise-on-the-aws-cloud.pdf#%5B%7B%22num%22%3A25%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%22XYZ%22%7D%2C69%2C709%2C0%5D

I'm getting the below error in SplunkCM
API: ec2:RunInstances Not authorized for images: [ami-0484972f36720ea7f]

I don't see this ami in my account. In my AWS account, I launched splunk on ami-0a5b63581103ff2ae. Not sure why its picking the wrong ami.
Anyone else facing the same issue? Any pointers would be helpful!

@bargarfj01
Copy link

replace in splunk-enterprise-template.yaml replace AMI number with new one you can find in AWS Marketplace after selecting Splunk ami+your AWS region

@lmsilvero
Copy link

lmsilvero commented Nov 3, 2021

Hi everyone,
Having the same issue when I use the new AMI version 8.2.2 Ami Id: ami-04bd6f47d7c4931fc, it seems like the ansible playbooks runs after of user data code.
These lines can be seen in the /var/log/cloud-init-output.log
mv: cannot stat ‘/opt/splunk/etc/passwd’: No such file or directory
/var/lib/cloud/instance/scripts/part-001: line 17: /opt/splunk/etc/system/local/user-seed.conf: No such file or directory
sed: can't read /etc/init.d/splunk: No such file or directory
service splunk restart
Redirecting to /bin/systemctl restart splunk.service
Failed to restart splunk.service: Unit not found.
Like sourabhparvatikar said in his post #41 it's like splunk is not installed in the AMI.
Another similar post https://community.splunk.com/t5/Splunk-Search/Splunk-Enterprise-AMI-and-Splunk-aws-Quickstart/m-p/424946

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants