Getting Data In

Installing an Independent Stream Forwarder in a Docker Container

j520551
New Member

Hello,

I am looking to forward all network traffic from a singular container (acting as a honeypot) to a Splunk Stream instance. Currently, I am performing this locally, with a free trial of Splunk, before eventually performing this online.

I have attempted various methods, and it seems an Independent Stream Forwarder appears the most appropriate. However, I am struggling to install an Independent Stream Forwarder in a Docker container.

Below you will find an image of the current iteration of the dockerfile and corresponding run output. Unfortunately, in this example, the log file is not generated, hindering the debug process.

example.png

 

I am well aware that the implementation above is not compliant with the one application, one container rule. However, it appears necessary for my intended use case. Furthermore, the logging alternatives such as Docker's Splunk Logging Driver and Splunk's Docker Logging Plugin, don't seem appropriate for this use case.

 

Thanks in advance.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...