topic Re: Splunk cluster in Docker / Kubernetes (Containerization) in Deployment Architecture

Splunk cluster in Docker / Kubernetes (Containerization)

splunkreal — Wed, 14 Jan 2026 14:50:22 GMT

Hello, anyone had experience with containers for Splunk cluster? Does it fit SHC kvstore for instance or indexers? Any risk?

Thanks!

Re: Splunk cluster in Docker / Kubernetes (Containerization)

PickleRick — Wed, 14 Jan 2026 15:14:22 GMT

There are several groups on Splunk Slack - #docker, #kubernetes and #splunk_operator_for_kubernetes (or something like this; easily findable). So you might get help there.

Generally - containerized Splunk to be "really functional" has to:

1) Externalize config and state

2) Expose ports

So if you can get those two elements done properly I don't see why shouldn't it work as SHC culster.

Having said that - I"m not an expert on containerized Splunk and I generally dislike containerized tools.

Re: Splunk cluster in Docker / Kubernetes (Containerization)

splunkreal — Wed, 14 Jan 2026 15:26:42 GMT

Thanks @PickleRick how would you externalize kvstore for instance?

Re: Splunk cluster in Docker / Kubernetes (Containerization)

PickleRick — Wed, 14 Jan 2026 15:37:36 GMT

As far as I remember, those containers mount stuff like $SPLUNK_HOME/etc and $SPLUNK_HOME/var/lib from outside. But into that you'd have to dig more yourself. My experience with dockerized Splunk is relatively limited (to let's spin up quickly some empty instance and check if it can do X or Y).

Re: Splunk cluster in Docker / Kubernetes (Containerization)

Wander — Thu, 15 Jan 2026 14:34:26 GMT

Here's a couple of projects from Splunk's github page:

https://github.com/splunk/docker-splunk

https://github.com/splunk/splunk-operator

I'm working through this as well, so I don't have a review or either yet