Does Splunk provide fully supported Docker universal forwarder ?

[splunkmachine]

We are looking at using the Docker Universal Forwarder for logging forwarding from the official GitHub Splunk repository.

https://github.com/splunk/docker-splunk/blob/master/universalforwarder/README.md

However, can you provide details on whether this is fully supported by Splunk ? Is a new version also release at each version update with Splunk ?

[woodcock]

I think you are looking at this backwards; it is docker that supports splunk:
https://docs.docker.com/engine/admin/logging/splunk/

[splunkmachine]

There are several methods to forward events. The link you posted is for the docker supported driver to Splunk via HEC. We have been exploring using the Splunk dockerised UF in the open source project to forward events for a slightly different use case. The other method to explore next is forwarding events via Google Cloud PUB/SUB subscription

[koshyk · Accepted solution]

please note, Splunk Docker UF is an open source project , so the versions change as when you like it. I changed it once 🙂 so you are not guarateed to get the same UF version when you pull.

If you want a specific stable version, my recommendation is to download the docker file. Change the splunk version and the build number and build and store this image for your local purposes. Ensure latest is tagged.

(While implementing inPROD environments, would be it better to install the UFs on the client machines rather all the client machines having docker environment.)

[splunkmachine]

Thanks for the quick reply. Yes this makes perfect sense however, just exploring methods for forwarding/streaming events realtime from Google Cloud Container into Splunk on premise

[ddrillic]

A cheerful presentation about the integration at
Containerization and Splunk: How Docker and Splunk Work Together