Getting Data In

Installing an Independent Stream Forwarder in a Docker Container

j520551
New Member

Hello,

I am looking to forward all network traffic from a singular container (acting as a honeypot) to a Splunk Stream instance. Currently, I am performing this locally, with a free trial of Splunk, before eventually performing this online.

I have attempted various methods, and it seems an Independent Stream Forwarder appears the most appropriate. However, I am struggling to install an Independent Stream Forwarder in a Docker container.

Below you will find an image of the current iteration of the dockerfile and corresponding run output. Unfortunately, in this example, the log file is not generated, hindering the debug process.

example.png

 

I am well aware that the implementation above is not compliant with the one application, one container rule. However, it appears necessary for my intended use case. Furthermore, the logging alternatives such as Docker's Splunk Logging Driver and Splunk's Docker Logging Plugin, don't seem appropriate for this use case.

 

Thanks in advance.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...