I'm trying to configure the splunk logging driver in docker to ingest the docker logs into splunk to be able to monitor them. An HTTP Event Collector has been set up on the heavy forwarder, and the index "app" has been chosen, along with letting the HEC automatically choosing the source/sourcetype (which I believe will be taken from the daemon below). Indexer acknowledgement is not enabled. In the daemon file on docker, this configuration was put in:
{
“log-driver”:”splunk”,
“log-opts”: {
“splunk-token”:”TOKEN-VALUE”,
“splunk-url”:"http://Hostname.blah.blah.com:8088”,
“splunk-index”:”app”,
“splunk-sourcetype”:”docker_logs”
}
}
It shows that there is a good connection over the port. However, no events are being indexed into splunk. I do not want to run the logging driver for the specific container, but rather set it as the default option for the future. Also I cannot download the docker app for splunk due to the extra software that must be installed alongside it. There are also no error messages anywhere so I am not sure what to edit. Any ideas?
