Remember that docker containers are volatile (except for the non-volatile space you "attach" to them) and docker images are "as is" after build so you'd have to either create a new image based on the ready-made splunk docker image or use the modify dockerfile to build a custom docker image from scratch.
Also, the whole idea of running Splunk in a docker environment is that you do an upgrade by pulling a newer version of the whole image so you'd need to customize your image each time a new version is released.
Hi @MattKr ,
Docker containers have only minimum requires tools. It is not easy to add additional tools. Don't think this as a standart linux distribution.