Getting Data In
Highlighted

Does Splunk provide fully supported Docker universal forwarder ?

Explorer

We are looking at using the Docker Universal Forwarder for logging forwarding from the official GitHub Splunk repository.

https://github.com/splunk/docker-splunk/blob/master/universalforwarder/README.md

However, can you provide details on whether this is fully supported by Splunk ? Is a new version also release at each version update with Splunk ?

0 Karma
Highlighted

Re: Does Splunk provide fully supported Docker universal forwarder ?

Ultra Champion

A cheerful presentation about the integration at
Containerization and Splunk: How Docker and Splunk Work Together

0 Karma
Highlighted

Re: Does Splunk provide fully supported Docker universal forwarder ?

Super Champion

please note, Splunk Docker UF is an open source project , so the versions change as when you like it. I changed it once 🙂 so you are not guarateed to get the same UF version when you pull.

If you want a specific stable version, my recommendation is to download the docker file. Change the splunk version and the build number and build and store this image for your local purposes. Ensure latest is tagged.

(While implementing inPROD environments, would be it better to install the UFs on the client machines rather all the client machines having docker environment.)

View solution in original post

0 Karma
Highlighted

Re: Does Splunk provide fully supported Docker universal forwarder ?

Explorer

Thanks for the quick reply. Yes this makes perfect sense however, just exploring methods for forwarding/streaming events realtime from Google Cloud Container into Splunk on premise

0 Karma
Highlighted

Re: Does Splunk provide fully supported Docker universal forwarder ?

Esteemed Legend

I think you are looking at this backwards; it is docker that supports splunk:
https://docs.docker.com/engine/admin/logging/splunk/

0 Karma
Highlighted

Re: Does Splunk provide fully supported Docker universal forwarder ?

Explorer

There are several methods to forward events. The link you posted is for the docker supported driver to Splunk via HEC. We have been exploring using the Splunk dockerised UF in the open source project to forward events for a slightly different use case. The other method to explore next is forwarding events via Google Cloud PUB/SUB subscription

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.