It looks like if I run the regex ("(Name)":"((\"|[^"])*)") on the config.v2.json file it name is listed but I now have to figure out how to get splunk universal forwarder to use that instead. ... View more

Oh very interesting. I took a look at /host/containers/ root@splunkuniversalforwarder:/opt/splunk# ls -lah /host/containers/ total 36K drwx------. 9 root root 4.0K Nov 8 18:14 . drwxr-xr-x 3 root root 24 Nov 8 18:14 .. drwx------ 3 root root 4.0K Nov 8 18:37 0bda263c181e2d5b36d4a66c97dbf227f0aeb8f5708bc75469c5776e7cb1ab0d drwx------ 3 root root 4.0K Nov 8 18:37 0fb22ca44d6a781dd3005d3972f1986928266eb0d0d5584f835d11799d220c27 drwx------ 3 root root 4.0K Nov 8 18:37 526edb07ef9255307dba4b841891f33125f4d3fd81667565229232a5debc901f drwx------ 3 root root 4.0K Nov 8 18:37 710257a95c0c6c71ef88f508d0110211de86908b4886ca47828664ca91d2021b drwx------ 3 root root 4.0K Nov 8 18:37 738ea4b1ca161c6c2f80698c8249e31565f6fed4e47da163c47ec68c25bc3c07 drwx------ 3 root root 4.0K Nov 8 18:37 753b3561356f0475216da4221797f038a1b3a79e340e260fbf7b390d166b1e3c drwx------ 3 root root 4.0K Nov 8 18:37 c76778c03115dc5b3ca350729b8a137b33d636ee47366061d3c3acf3a3631f57 And then picked one and ran: ls -lah /host/containers/c76778c03115dc5b3ca350729b8a137b33d636ee47366061d3c3acf3a3631f57/ which returned: total 40K drwx------ 3 root root 4.0K Nov 8 18:37 . drwx------. 9 root root 4.0K Nov 8 18:14 .. -rw-r----- 1 root root 0 Nov 8 18:14 c76778c03115dc5b3ca350729b8a137b33d636ee47366061d3c3acf3a3631f57-json.log -rw-rw-rw- 1 root root 3.3K Nov 8 18:37 config.v2.json -rw-rw-rw- 1 root root 1.1K Nov 8 18:37 hostconfig.json -rw-r--r-- 1 root root 13 Nov 8 18:37 hostname -rw-r--r-- 1 root root 150 Nov 8 18:37 hosts -rw-r--r-- 1 root root 76 Nov 8 18:37 resolv.conf -rw-r--r-- 1 root root 71 Nov 8 18:37 resolv.conf.hash drwx------ 2 root root 4.0K Nov 8 18:14 shm Lastly I cat'd the hostname file in that folder and it shows the 12 digit container id c76778c03115 ... View more

Hope this helps? Thanks for the input. Added to pastebin because it was too long for the amount of characters available. http://pastebin.com/C30iLrDv ... View more

from what I understand (again I am fairly new to Splunk) Splunk Universal Forwarder is pulling the docker logs via the location that docker saves them to on the host and pushes them to Splunk. ... View more

Not really sure what you mean? the containers are properly named. SUF doesnt look at that though because it is pulling the logs that docker posts in json format on the host. ... View more

Splunk universal forwarder (SUF) isnt installed on each container. SUF is running as a container and is collecting the logs of each container from the stdout log of each container. ... View more