How Can I Get My Splunk Container to Monitor its Host?

[VCorralPlex21]

Hello all!

   I am unable to ingest log data from the host on which my docker container resides.  Since it is a container I do not have access to the host logs.  I also tried installing a universal forwarder on the host, but since the ports 8089 and 9997 are already bound to the container that does not work.  I would appreciate any suggestions.

Regards,

Virgil

[richgalloway]

Since a container has no awareness of its host, you'll need a UF on the host itself.  The UF does not use port 9997 so that's not an issue.  You can reassign port 8089 to another port in web.conf or disable it entirely in server.conf.