All Apps and Add-ons

Cannot get logs from Firewall to the Splunk docker container

felipe_gonzalez
New Member

Hello team,

Need some help here, sure you guys are really.

White me with some inside on how I can use containers better.

Desired goal:

Get the logs from Firewall > Synology > Docker Container[splunk-splunk]

Actions Taken:

Logs are being sent out from origin: syslog server

Created an entry in the syslog server to send messages to IP:6515 (Synology DSM)

Modified port settings at Docker to have a Local port:6515 | Container port:9997

Docker bridge displays auto subnet 172.17.0/16 with gateway 172.17.0.1

Result:

At this moment I can access the Splunk web GUI under localhost:8000 with no problem, I see "ALL" logs tagged with a sourcing IP 172.17.0.1 that belongs to the bridge Gateway on the docker driver.

If the desired goal is to monitor the logs from the syslog server in a more verbose manner, how you guys advise configuring the receiving aspect of Docker (container/Splunk) to make this happen.

Log detail sample:

date_zone = local
host = 172.17.0.1
process = filterlog
source = udp:9997
sourcetype = syslog
splunk_server = 039974fdab5a
timeendpos = 15

0 Karma

felipe_gonzalez
New Member
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...