Getting Data In

Does Splunk provide fully supported Docker universal forwarder ?

Explorer

We are looking at using the Docker Universal Forwarder for logging forwarding from the official GitHub Splunk repository.

https://github.com/splunk/docker-splunk/blob/master/universalforwarder/README.md

However, can you provide details on whether this is fully supported by Splunk ? Is a new version also release at each version update with Splunk ?

0 Karma
1 Solution

Super Champion

please note, Splunk Docker UF is an open source project , so the versions change as when you like it. I changed it once 🙂 so you are not guarateed to get the same UF version when you pull.

If you want a specific stable version, my recommendation is to download the docker file. Change the splunk version and the build number and build and store this image for your local purposes. Ensure latest is tagged.

(While implementing inPROD environments, would be it better to install the UFs on the client machines rather all the client machines having docker environment.)

View solution in original post

0 Karma

Esteemed Legend

I think you are looking at this backwards; it is docker that supports splunk:
https://docs.docker.com/engine/admin/logging/splunk/

0 Karma

Explorer

There are several methods to forward events. The link you posted is for the docker supported driver to Splunk via HEC. We have been exploring using the Splunk dockerised UF in the open source project to forward events for a slightly different use case. The other method to explore next is forwarding events via Google Cloud PUB/SUB subscription

0 Karma

Super Champion

please note, Splunk Docker UF is an open source project , so the versions change as when you like it. I changed it once 🙂 so you are not guarateed to get the same UF version when you pull.

If you want a specific stable version, my recommendation is to download the docker file. Change the splunk version and the build number and build and store this image for your local purposes. Ensure latest is tagged.

(While implementing inPROD environments, would be it better to install the UFs on the client machines rather all the client machines having docker environment.)

View solution in original post

0 Karma

Explorer

Thanks for the quick reply. Yes this makes perfect sense however, just exploring methods for forwarding/streaming events realtime from Google Cloud Container into Splunk on premise

0 Karma

Ultra Champion

A cheerful presentation about the integration at
Containerization and Splunk: How Docker and Splunk Work Together

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!