Skip to content

Commit 03df47c

Browse files
authored
(docs) update docs/STORAGE_OPTIONS.md (#495)
- add languages to code fences - remove verbiage - fix article agreement - fix yaml
1 parent c2ab935 commit 03df47c

File tree

1 file changed

+18
-18
lines changed

1 file changed

+18
-18
lines changed

docs/STORAGE_OPTIONS.md

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
## Data Storage ##
2-
This section will cover examples of different options for configuring data persistence. This includes both indexed data and configuration items. Splunk only supports data persistence to volumes mounted outside of the container. Data persistence for folders inside of the container is not supported. The following are intended as only as examples and unofficial guidelines.
2+
This section will cover examples of different options for configuring data persistence. This includes both indexed data and configuration items. Splunk only supports data persistence to volumes mounted outside of the container. Data persistence for folders inside of the container is not supported. The following are intended only as examples and unofficial guidelines.
33

44
### Storing indexes and search artifacts ###
5-
Splunk Enterprise, by default, Splunk Enterprise uses the var directory for indexes, search artifacts, etc. In the public image, the Splunk Enterprise home directory is /opt/splunk, and the indexes are configured to run under var/. If you want to persist the indexed data, then mount an external directory into the container under this folder.
5+
By default, Splunk Enterprise uses the var directory for indexes, search artifacts, etc. In the public image, the Splunk Enterprise home directory is /opt/splunk, and the indexes are configured to run under var/. If you want to persist the indexed data, then mount an external directory into the container under this folder.
66

77
If you do not want to modify or persist any configuration changes made outside of what has been defined in the docker image file, then use the following steps for your service.
88

@@ -13,10 +13,10 @@ docker volume create so1-var
1313
```
1414
See Docker's official documentation for more complete instructions and additional options.
1515

16-
#### Step 2: Define the docker compose YAML and start the service####
16+
#### Step 2: Define the docker-compose YAML and start the service ####
1717
Using the Docker Compose format, save the following contents into a docker-compose.yml file:
1818

19-
```
19+
```yaml
2020
version: "3.6"
2121

2222
networks:
@@ -46,7 +46,7 @@ services:
4646
- so1-var:/opt/splunk/var
4747
```
4848
49-
This mounts only the contents of /opt/splunk/var, so anything outside of this folder will not persist. Any configuration changes will not remain when the container exits. Note that changes will persist between starting and stopping a container. See the Docker documentation for more discussion on the difference between starting, stopping, and exiting if the difference between them is unclear.
49+
This mounts only the contents of /opt/splunk/var, so anything outside this folder will not persist. Any configuration changes will not remain when the container exits. Note that changes will persist between starting and stopping a container. See the Docker documentation for more discussion on the difference between starting, stopping, and exiting if the difference between them is unclear.
5050
5151
In the same directory as `docker-compose.yml`, run the following command to start the service.
5252
```
@@ -61,21 +61,21 @@ docker volume inspect so1-var
6161
The output of that command should list where the data is stored.
6262
6363
### Storing indexes, search artifacts, and configuration changes ###
64-
In this section, we build off of the previous example to save the configuration as well. This can make it easier to save modified configurations, but simultaneously allows configuration drift to occur. If you want to keep configuration drift from happening, but still want to be able to persist some of the data, you can save off the specific "local" folders that you want the data to be persisted for (such as etc/system/local). However, be careful when doing this because you will both know what folders you need to save off and the number of volumes can proliferate rapidly - depending on the deployment. Please take the "Administrating Splunk" through Splunk Education prior to attempting this configuration.
64+
In this section, we build off of the previous example to save the configuration as well. This can make it easier to save modified configurations, but simultaneously allows configuration drift to occur. If you want to keep configuration drift from happening, but still want to persist some of the data, you can save off the specific "local" folders that you want the data to be persisted for (such as etc/system/local). However, be careful when doing this because you will both know what folders you need to save off and the number of volumes can increase rapidly - depending on the deployment. Please take the "Administrating Splunk" through Splunk Education before attempting this configuration.
6565
66-
In these examples, we will assume that the entire etc folder is being mounted into the container.
66+
We will assume that the entire /etc folder is being mounted into the container in these examples.
6767
6868
#### Step 1: Create a named volume ####
6969
Again, create a simple named volume in your Docker environment, run the following command
70-
```
70+
```shell
7171
docker volume create so1-etc
7272
```
7373
See Docker's official documentation for more complete instructions and additional options.
7474

7575
#### Step 2: Define the Docker Compose YAML ####
7676
Notice that this differs from the previous example by adding in the so1-etc volume references. In the following example, save the following data into a file named `docker-compose.yml`.
7777

78-
```
78+
```yaml
7979
version: "3.6"
8080

8181
networks:
@@ -104,19 +104,19 @@ services:
104104
- 8089
105105
volumes:
106106
- so1-var:/opt/splunk/var
107-
- so1-etc:/opt/splunk/etc
107+
- so1-etc:/opt/splunk/etc
108108
```
109109
110110
In the same directory as `docker-compose.yml`, run the following command to start the service:
111-
```
111+
```shell
112112
docker-compose up
113113
```
114114

115-
When the volume is mounted the data will persist after the container exits. If a container has exited and restarted, but no data shows up, then check the volume definition and verify that the container did not create a new volume or that the volume mounted is in the same location.
115+
When the volume is mounted, the data will persist after the container exits. If a container has exited and restarted, but no data shows up, check the volume definition and verify that the container did not create a new volume or that the volume mounted is in the same location.
116116

117117
#### Viewing the contents of the volume ####
118-
To view the etc directory outside of the container run one or both of the commands
119-
```
118+
To view the /etc directory outside of the container, run one or both of the commands
119+
```shell
120120
docker volume inspect so1-etc
121121
```
122122
The output of that command should list the directory associated with the volume mount.
@@ -135,7 +135,7 @@ In the same yaml file you initially used to deploy Splunk instances, update the
135135

136136
Below is an example yaml with `SPLUNK_UPGRADE=true`:
137137

138-
```
138+
```yaml
139139
version: "3.6"
140140
141141
networks:
@@ -165,13 +165,13 @@ services:
165165
- 8089
166166
volumes:
167167
- so1-var:/opt/splunk/var
168-
- so1-etc:/opt/splunk/etc
168+
- so1-etc:/opt/splunk/etc
169169
```
170170

171171
#### Step 3: Deploy your containers using the updated yaml ####
172-
Similar to how you initially deployed your containers, run the command with the updated yaml that contains a reference to the new image and SPLUNK_UPGRADE=true in the environment. Make sure that you do NOT destroy previously existing network and volumes. After running the command with the yaml file, your containers should be recreated with the new version of Splunk and persisted data properly mounted to /opt/splunk/var and /opt/splunk/etc.
172+
Like how you initially deployed your containers, run the command with the updated yaml containing a reference to the new image and SPLUNK_UPGRADE=true in the environment. Make sure that you do NOT destroy previously existing networks and volumes. After running the command with the yaml file, your containers should be recreated with the new version of Splunk and persisted data properly mounted to /opt/splunk/var and /opt/splunk/etc.
173173

174174
#### Different types of volumes ####
175-
Using named volume is recommended so it is easier to attach and detach volumes to different Splunk instances while persisting your data. If you use anonymous volumes, Docker gives them random and unique names so you can still reuse anonymous volumes on different containers. If you use bind mounts, make sure that the mounts are setup properly to persist /opt/splunk/var and opt/splunk/etc. Starting new containers without proper mounts will result in a loss of your data.
175+
Using named volume is recommended because it is easier to attach and detach volumes to different Splunk instances while persisting your data. If you use anonymous volumes, Docker gives them random and unique names so you can still reuse anonymous volumes on other containers. If you use bind mounts, make sure that the mounts are set up correctly to persist /opt/splunk/var and opt/splunk/etc. Starting new containers without proper mounts will result in a loss of your data.
176176

177177
See [Create and manage volumes](https://docs.docker.com/storage/volumes/#create-and-manage-volumes) in the Docker documentation for more information.

0 commit comments

Comments
 (0)