Splunk Enterprise

splunk universal forwarder installation issue in docker

New Member

I have Splunk enterprise installed in docker on port 8000 as follows: 

docker run -it --name=splunk -p 8000:8000 -p 8088:8088 -v splunk_etc:/opt/splunk/etc -v splunk_var:/opt/splunk/var -e SPLUNK_START_ARGS=--accept-license -e SPLUNK_PASSWORD=<password> splunk/splunk:latest start

I am trying to install universal forwarder to forward log files to splunk instance. I used the command from this link : https://docs.splunk.com/Documentation/Forwarder/8.2.0/Forwarder/Deployandrunauniversalforwarderinsid...

docker run -d -p 9997:9997 -e SPLUNK_START_ARGS='--accept-license' -e SPLUNK_PASSWORD='<password>' --name uf splunk/universalforwarder:latest

and get the following error: 


Does a HEC need to be set-up for file forwarding?. 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...