Hi
I am running splunk in dosker using following command ..
docker run -d -p 8000:8000 -p
8088:8088 -p 9997:9997 -p 1514:1514
--restart=always --name splunk --hostname splunk \ -e "SPLUNK_START_ARGS=--accept-license" \
-e "SPLUNK_PASSWORD=admin2675" \ -e "SPLUNK_ENABLE_LISTEN=9997" \ -e
"SPLUNK_ADD=tcp 1514" \ -v
/root/splunk/etc:/opt/splunk/etc \
-v /root/splunk/var:/opt/splunk/var \ splunk/splunk
Output ..
[root@k8s-master ~]# docker ps -a |
grep splunk 9a127fb5e2e4
splunk/splunk
"/sbin/entrypoint...." 42 minutes
ago Up 42 minutes (healthy)
0.0.0.0:1514->1514/tcp, 0.0.0.0:8000->8000/tcp, 8065/tcp, 8089/tcp, 8191/tcp,
0.0.0.0:8088->8088/tcp, 0.0.0.0:9997->9997/tcp, 9887/tcp splunk
Created HEC and its enabled also.
Sucessfully send event using curl ...
curl -k
https://10.128.0.33:8088/services/collector/event -H "Authorization: Splunk 992e8305-26ef-4933-97de-1135f0776dda"
-d '{"event": "Hello World, Prasen"}'
But in console search not able to find anything, not even "Hello World, Prasen" event also.
Not found host, source type, source
Please advice ..
