Hello,
I am looking to forward all network traffic from a singular container (acting as a honeypot) to a Splunk Stream instance. Currently, I am performing this locally, with a free trial of Splunk, before eventually performing this online.
I have attempted various methods, and it seems an Independent Stream Forwarder appears the most appropriate. However, I am struggling to install an Independent Stream Forwarder in a Docker container.
Below you will find an image of the current iteration of the dockerfile and corresponding run output. Unfortunately, in this example, the log file is not generated, hindering the debug process.
I am well aware that the implementation above is not compliant with the one application, one container rule. However, it appears necessary for my intended use case. Furthermore, the logging alternatives such as Docker's Splunk Logging Driver and Splunk's Docker Logging Plugin, don't seem appropriate for this use case.
Thanks in advance.
