Splunk Docker Error on boot

[Grand-Duc]

Log retrieved from splunk docker logs when launching master

TASK [splunk_common : Start Splunk via CLI] ************************************
fatal: [localhost]: FAILED! => {
    "attempts": 5,
    "changed": false,
    "cmd": [
        "/opt/splunk/bin/splunk",
        "start",
        "--accept-license",
        "--answer-yes",
        "--no-prompt"
    ],
    "delta": "0:00:01.078795",
    "end": "2024-11-19 09:30:55.588686",
    "rc": 1,
    "start": "2024-11-19 09:30:54.509891"
}

STDOUT:


Splunk> CSI: Logfiles.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking appserver port [127.0.0.1:8065]: open
        Checking kvstore port [8191]: open
        Checking configuration... Done.


STDERR:

The CA file specified (/opt/splunk/etc/auth/cacert.pem) does not exist. Cannot continue.
SSL certificate generation failed.


MSG:

non-zero return code

[maxspl]

Hi, we've had this error several times already but haven't found a fix, however a temporary workaround is to restart Splunk docker (from setup/master: sudo docker compose --profile splunk up -d).
I will keep the issue open until a fix is found.