Not receiving event - docker splunk

prasenforu — Wed, 30 Sep 2020 02:42:33 GMT

I am running splunk in dosker using following command ..

docker run -d -p 8000:8000 -p
8088:8088 -p 9997:9997 -p 1514:1514
--restart=always --name splunk --hostname splunk \ -e "SPLUNK_START_ARGS=--accept-license" \
-e "SPLUNK_PASSWORD=admin2675" \ -e "SPLUNK_ENABLE_LISTEN=9997" \ -e
"SPLUNK_ADD=tcp 1514" \ -v
/root/splunk/etc:/opt/splunk/etc \

-v /root/splunk/var:/opt/splunk/var \ splunk/splunk

Output ..

[root@k8s-master ~]# docker ps -a |
grep splunk 9a127fb5e2e4

splunk/splunk

"/sbin/entrypoint...." 42 minutes
ago Up 42 minutes (healthy)

0.0.0.0:1514->1514/tcp, 0.0.0.0:8000->8000/tcp, 8065/tcp, 8089/tcp, 8191/tcp,
0.0.0.0:8088->8088/tcp, 0.0.0.0:9997->9997/tcp, 9887/tcp splunk

Created HEC and its enabled also.

Sucessfully send event using curl ...

curl -k
https://10.128.0.33:8088/services/collector/event -H "Authorization: Splunk 992e8305-26ef-4933-97de-1135f0776dda"
-d '{"event": "Hello World, Prasen"}'

But in console search not able to find anything, not even "Hello World, Prasen" event also.

Not found host, source type, source

Please advice ..

topic Not receiving event - docker splunk in Getting Data In

Not receiving event - docker splunk