Hello,
I have a windows 10 machine on which I have installed splunk enterprise server (indexer) and on another linux VM I have installed the forwarder as a docker container.
For the forwarder, I have created a volume (monitoring /var/lib/docker) and mapped it to the above docker container.
sudo docker run -d -p 9997:9997 -v simplevol:/var/lib/docker -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=admin@123" --name splunkcontainer splunk/universalforwarder:8.2
I need to monitor the /var/lib/docker folder on linux and send it to my windows server index for any changes. But I am not able to achieve that when I install the agent as a container. (If I go with normal install it works fine and data is sent to index)
Could anyone help me on how to achieve the communication between forwarder agent container and windows indexer
