Getting Data In

How to install and configure a universal forwarder on servers that are running applications in a Docker container?

Path Finder


i was looking at Splunk docs regarding how to install Splunk forwarder and configure inputs to forward logs from Docker container. Unluckily, I could not find any thing. Can any one help me in what is the process to install and read logs from Docker container??

Thanks in advance

0 Karma

Path Finder


Before I present you some possible links for further reading, I must state that I have not done this myself yet.

Back in 2015 Splunk blog had a development blog entry about "Integrating Splunk with Docker, CoreOS and JournalID".
In the blog post it explains how to integrate a universal forwarder into an environment where all applications are run in docker containers, and thus do not support regular installation of a forwarder. Docker container used for the Splunk forwarder is publicly available in the Docker hub. Source is available on Github.

I believe that the above mentioned blogpost would assist you in your problem.

Sorry that I could not assist you further with a solution.


0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!