Splunk cluster in Docker / Kubernetes (Containerization)

[splunkreal]

Hello, anyone had experience with containers for Splunk cluster? Does it fit SHC kvstore for instance or indexers? Any risk?

Thanks!

[Wander]

Here's a couple of projects from Splunk's github page:

https://github.com/splunk/docker-splunk

https://github.com/splunk/splunk-operator

I'm working through this as well, so I don't have a review or either yet

[PickleRick]

There are several groups on Splunk Slack - #docker, #kubernetes and #splunk_operator_for_kubernetes (or something like this; easily findable). So you might get help there.

Generally - containerized Splunk to be "really functional" has to:

1) Externalize config and state

2) Expose ports

So if you can get those two elements done properly I don't see why shouldn't it work as SHC culster.

Having said that - I"m not an expert on containerized Splunk and I generally dislike containerized tools.

[splunkreal]

Thanks @PickleRick  how would you externalize kvstore for instance?

[PickleRick]

As far as I remember, those containers mount stuff like $SPLUNK_HOME/etc and $SPLUNK_HOME/var/lib from outside. But into that you'd have to dig more yourself. My experience with dockerized Splunk is relatively limited (to let's spin up quickly some empty instance and check if it can do X or Y).