topic Does Splunk provide fully supported Docker universal forwarder ? in Getting Data In

Does Splunk provide fully supported Docker universal forwarder ?

splunkmachine — Mon, 11 Sep 2017 13:09:05 GMT

We are looking at using the Docker Universal Forwarder for logging forwarding from the official GitHub Splunk repository.

https://github.com/splunk/docker-splunk/blob/master/universalforwarder/README.md

However, can you provide details on whether this is fully supported by Splunk ? Is a new version also release at each version update with Splunk ?

Re: Does Splunk provide fully supported Docker universal forwarder ?

ddrillic — Mon, 11 Sep 2017 13:32:44 GMT

A cheerful presentation about the integration at
Containerization and Splunk: How Docker and Splunk Work Together

Re: Does Splunk provide fully supported Docker universal forwarder ?

koshyk — Mon, 11 Sep 2017 14:16:01 GMT

please note, Splunk Docker UF is an open source project , so the versions change as when you like it. I changed it once 🙂 so you are not guarateed to get the same UF version when you pull.

If you want a specific stable version, my recommendation is to download the docker file. Change the splunk version and the build number and build and store this image for your local purposes. Ensure latest is tagged.

(While implementing inPROD environments, would be it better to install the UFs on the client machines rather all the client machines having docker environment.)

Re: Does Splunk provide fully supported Docker universal forwarder ?

woodcock — Mon, 11 Sep 2017 14:28:30 GMT

I think you are looking at this backwards; it is docker that supports splunk:
https://docs.docker.com/engine/admin/logging/splunk/

Re: Does Splunk provide fully supported Docker universal forwarder ?

splunkmachine — Mon, 11 Sep 2017 15:23:50 GMT

Thanks for the quick reply. Yes this makes perfect sense however, just exploring methods for forwarding/streaming events realtime from Google Cloud Container into Splunk on premise

Re: Does Splunk provide fully supported Docker universal forwarder ?

splunkmachine — Mon, 11 Sep 2017 17:34:07 GMT

There are several methods to forward events. The link you posted is for the docker supported driver to Splunk via HEC. We have been exploring using the Splunk dockerised UF in the open source project to forward events for a slightly different use case. The other method to explore next is forwarding events via Google Cloud PUB/SUB subscription