Hi all, I want to retrieve the event logs of a docker container with a custom index that I created using the Splunk web interface. Details about the custom index Name: abc App: app-docker Home Path: $SPLUNK_DB/abc/db When I use this index to get container logs, I cannot find the container running in Docker Overview dashboard (Logs by Container - Splunk Logging Driver, https://docs.docker.com/engine/admin/logging/splunk/). I can only find containers which uses main index. How can I retrieve container logs that use tokens referencing to this custom index? Thank you. ... View more

Hi all, I am trying to setup Splunk using docker-compose by referring to https://github.com/splunk/docker-splunk/tree/master/enterprise#configure-the-splunk-enterprise-docker-container-with-docker-compose. I created a docker-compose.yml accordingly and ran docker-compose up. But that gives me the following error. ERROR: The Compose file './docker-compose.yml' is invalid because: Unsupported config option for services.vsplunk: 'splunk' My Docker-compose version docker-compose version 1.12.0, build b31ff33 Any suggestions to resolve this, please? Thank you. ... View more

Hi all, I am a newbie to Splunk and since few days, I am attempting to use Splunk to retrieve docker container logs. I tried using docker image of Splunk Enterprise. With that, I could access the Splunk instance on the browser through http://localhost:8000. Thereafter, I am stuck. I used the following command and that gave me the following error message. docker run --log-driver=splunk --log-opt splunk-url=http://localhost:8000 --log-opt splunk-token=B0AE18EB-4A5F-4A78-911D-033265BA430A nginx docker: Error response from daemon: Failed to initialize logging driver: splunk: failed to verify connection - 303 See Other - http-equiv="content-type" content="text/html; charset=UTF-8"> ... View more