Splunk Search

Splunk Daemonset for kubernetes not indexing data due to read only filesystem

vidhijain333
Loves-to-Learn

I have configured splunk daemonset for k8s cluster. Agent logs are flowing. However the application logs are not getting indexed, as /var/lib/docker/containers is owned by root and a read only file system.
Also I am not able to change permissions of /var/lib/docker/containers. PS - We are running splunk agent with a non-root user.

Any help ?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...