Universal Forwarder not communicating to server

ghostlab — Tue, 06 Oct 2020 22:14:46 GMT

I have an Alpine image with splunk forwarder installed in it. I am trying to monitor one log file from with in the container and log it to the splunk server.

Step 1: Base image with Alpine and unzipped splunkforwarder.tgz file

Step 2: Using this base image to dockerize my node application.

RUN ../../../opt/splunk/bin/splunk start --accept-license --answer-yes --seed-passwd password

RUN ../../../opt/splunk/bin/splunk add forward-server server-ip:9997 -auth admin:username

RUN ../../../opt/splunk/bin/splunk add monitor ./logs -sourcetype logs

RUN ../../../opt/splunk/bin/splunk restart

RUN ../../../opt/splunk/bin/splunk enable boot-start #dont know if its needed

I am still not receiving any logs in the splunk server. Is there anything I need to do for the spluk forwarder to communicate with splunk-server from with in the container.

Thank you.

topic Universal Forwarder not communicating to server in Getting Data In

Universal Forwarder not communicating to server