Splunk Enterprise

Containerized Splunk Universal Forwarder on OpenShift, is it possible to control them with a Splunk Deployment Server?

edoardo_vicendo
Contributor

Hello,

We are going to have several OpenShift 4 clusters  running CoreOS, therefore without having the possibility to install a standard version of the Splunk Universal Forwarder.

Do you think is possible, installing a containerized version of the Splunk Universal Forwarder on each OpenShift node, to let it connect to a Splunk Deployment server (not containerized) in order to control them centrally?

Thanks a lot,
Edoardo

Labels (3)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

In general, it should be possible as long as you keep the configuration and data persistent thus defeating the whole purpose of containerization. But yes, if you define volumes for /opt/splunk/etc and  /opt/splunk/var, you should be ready to go - the containerized setup should work the same as normal splunk installation. The only caveat being - I'm not sure how it will react to version upgrade in the repository if you'll specify that the latest version should be run.

Oh, and of course since the container is run in its own namespace you need to take care to pass appropriate ports to the container if you want to listen on them for network events and bits of the host's filesystem if you want to monitor files.

Which in general makes it a bit pointless (as is the case with the whole idea of containerized splunk IMO but that's me).

But if you have no other option of running anything "directly" on the host, that might work.

Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...