Getting Data In

Failed to receive logs from Docker with Splunk Logging Driver

xzou_splunk
Splunk Employee
Splunk Employee

Hi all,

I followed the instruction in https://github.com/splunk/docker-logging-plugin to install the log driver, and also setup the HEC in Splunk.
Tried following:
1. docker run --publish 4000:80 --log-driver=splunk-logging-plugin --log-opt splunk-token=xxxxx --log-opt splunk-url=https://127.0.0.1:8088 xxxx; No logs in Splunk
2. Change docker daemon as
{
"debug" : true,
"experimental" : false,
"log-driver": "splunk-logging-plugin",
"log-opts": {
"splunk-token": "xxxxxx",
"splunk-url": "https://127.0.0.1:8088",
"splunk-insecureskipverify": "true"
}
}
No logs in Splunk
3. curl -k https://127.0.0.1:8088/services/collector/event -H "Authorization: Splunk xxxxxx" -d '{"event": "hello world"}'
Receive return meg: {"text": "Success", "code": 0}, and got logs in Splunk

Any advice where is the problem or how should I debug this?

Thanks.

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...