Getting Data In

In order customize my Docker image, how should I download and install Splunk Forwarder on *nix systems?

jigarashah
New Member

I am trying to customize my Docker image (a Cassandra image) so it also has Splunk Forwarder with Cassandra add-on. Can you please guide how to do so? main issue is downloading headless (both add-on and forwarder)

http://docs.splunk.com/Documentation/Splunk/6.5.1/Installation/InstallonLinux

0 Karma
1 Solution

craigv_splunk
Splunk Employee
Splunk Employee

In your Dockerfile you can use wget to download the forwarder and the app. You can have it pulldown the tarball version of the splunk binary and you can unpack it by specifying in the Dockerfile. Then for the app you can download that using wget as well and drop it in the $Splunk_Home/etc/apps folder. Alternatively you can build the image on your machine and copy the app from your local machine.

See the official Splunk universal forwarder Dockerfile for inspiration: https://github.com/splunk/docker-splunk/blob/master/universalforwarder/Dockerfile

View solution in original post

0 Karma

craigv_splunk
Splunk Employee
Splunk Employee

In your Dockerfile you can use wget to download the forwarder and the app. You can have it pulldown the tarball version of the splunk binary and you can unpack it by specifying in the Dockerfile. Then for the app you can download that using wget as well and drop it in the $Splunk_Home/etc/apps folder. Alternatively you can build the image on your machine and copy the app from your local machine.

See the official Splunk universal forwarder Dockerfile for inspiration: https://github.com/splunk/docker-splunk/blob/master/universalforwarder/Dockerfile

View solution in original post

0 Karma

jigarashah
New Member

Exactly what I wanted. What about addons ? they have same static url ? unable to browse so just asking...

0 Karma

vrathore2016
New Member
0 Karma

gjanders
SplunkTrust
SplunkTrust

Now https://github.com/splunk/docker-splunk/blob/master/uf/debian-9/Dockerfile or refer to the more general link of https://github.com/splunk/docker-splunk/

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@jigarashah - Did the answer provided by @craigv provide a solution to your original question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

somesoni2
Revered Legend

You can download both add-on and Universal Forwarder installable to a repository accessible from nix servers and then run a script to install both.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!