{"id":22615581,"url":"https://github.com/marcellodesales/universal-splunk-forwarder-docker-image","last_synced_at":"2025-03-29T00:42:32.063Z","repository":{"id":142073106,"uuid":"50113639","full_name":"marcellodesales/universal-splunk-forwarder-docker-image","owner":"marcellodesales","description":"Universal docker Splunk forwarder 6.2 for those who hasn't migrated to Splunk 6.3+ with the native drivers.","archived":false,"fork":false,"pushed_at":"2016-02-16T22:39:15.000Z","size":9,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-02-03T10:46:22.068Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/marcellodesales.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-01-21T14:39:01.000Z","updated_at":"2019-09-03T00:42:11.000Z","dependencies_parsed_at":"2023-05-03T02:56:35.626Z","dependency_job_id":null,"html_url":"https://github.com/marcellodesales/universal-splunk-forwarder-docker-image","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcellodesales%2Funiversal-splunk-forwarder-docker-image","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcellodesales%2Funiversal-splunk-forwarder-docker-image/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcellodesales%2Funiversal-splunk-forwarder-docker-image/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcellodesales%2Funiversal-splunk-forwarder-docker-image/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/marcellodesales","download_url":"https://codeload.github.com/marcellodesales/universal-splunk-forwarder-docker-image/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246122244,"owners_count":20726822,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-08T19:08:24.957Z","updated_at":"2025-03-29T00:42:32.012Z","avatar_url":"https://github.com/marcellodesales.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Universal Splunk Forwarder Docker Image\n\n**ATTENTION**: Universal SplunkForwarder Docker image for those running **Splunk 6.2**.\nThis is a very specific and can be replaced with the native Splunk\nnative Docker driver once you migrate to [Splunk 6.3+](http://blogs.splunk.com/2015/12/16/splunk-logging-driver-for-docker/) (see [example](http://blogs.splunk.com/2015/12/16/splunk-logging-driver-for-docker/comment-page-1/#comment-2677755))\n\n[![img](http://dockeri.co/image/marcellodesales/universal-splunk-forwarder)](https://hub.docker.com/r/marcellodesales/universal-splunk-forwarder)\n\nThis is based on the awesome work from [outcoldman/splunk](https://github.com/outcoldman/docker-splunk). \n\n# Parent Image\n\n* The parent image is [outcoldman/splunk:6.2.4-forwarder](https://hub.docker.com/r/outcoldman/splunk/)\n\n# Requirements\n\n* You need to provide the configuration files with the different\nstanzas at `/opt/splunk/etc/system/local/` including `inputs.conf`, \n`outputs.conf`, `migration.conf`, `server.conf`.\n* You need to collect from /var/log/messages.\n* You need to use syslog format.\n\nIf you need a custom value for those input files, please take a look\nat the directory `./etc-system-local`.\n\n# Building\n\n```\n$ docker build -t splunkforwarder .\nSending build context to Docker daemon 10.24 kB\nBuilding splunkforwarder\nStep 1 : FROM outcoldman/splunk:6.2.4-forwarder\n ---\u003e 06938dba3cbe\nStep 2 : MAINTAINER Marcello_deSales@intuit.com\n ---\u003e Using cache\n ---\u003e 24b557d9d31f\nStep 3 : ENV SPLUNK_USER root\n ---\u003e Using cache\n ---\u003e 41508e45938a\nStep 4 : ENV SPLUNK_GROUP root\n ---\u003e Using cache\n ---\u003e 209329ab707f\nStep 5 : COPY ./etc-system-local /tmp/splunk\n ---\u003e 776c58b71c7e\nRemoving intermediate container a774e2f5a306\nStep 6 : COPY ./patch-entrypoint.sh /sbin/entrypoint.sh\n ---\u003e b1511957ecc7\nRemoving intermediate container 3b5f0d5eb311\nSuccessfully built b1511957ecc7\n```\n\n# Running from Docker Compose\n\n* You can use a data container for the messages\n* You can set the proper time of the collection to the host.\n* You need to provide env vars `FORWARD_HOSTNAME`, `SPLUNK_INDEX`, `SPLUNK_OUTPUT_SERVER`, which are used\n  to replace the values under `./etc-system-local/server.conf` and \n  `./etc-system-local/inputs.conf`.\n\n```yml\nsplunkforwarderData:\n  image: busybox\n  volumes:\n    - /var/log/messages:/var/log/messages:ro\n    - /usr/share/zoneinfo/America/Los_Angeles:/etc/localtime:ro\n\nsplunkforwarder:\n  image: marcellodesales/universal-splunk-forwarder:6.2\n  restart: always\n  environment:\n    - FORWARD_HOSTNAME=${HOSTNAME}\n    - SPLUNK_INDEX=my-server-idx\n    - SPLUNK_OUTPUT_SERVER=splunk1.corp.company.net:9997, splunk2.corp.company.net:9997\n  volumes_from:\n    - \"splunkforwarderData\"\n```\n\nRunning `splunk.yml` as follows:\n\n```\n$ docker-compose -f splunk.yml up -d\nCreating npmoserver_splunkforwarderData_1\nCreating npmoserver_splunkforwarder_1\n```\n\n# Setting Up Application services\n\nThis Splunk forwarder is sending anything that goes to /var/log/messages. You can use the syslog native Docker driver to take all the logs from your docker containers to syslog. Remember to use the `log_driver: syslog` and `log_opt.syslog_tag: NAME` to see those in Splunk better.\n\n```yml\n\ncouchdb:\n  build: roles/couchdb\n  restart: always\n  ports:\n    - \"55984:5984\"\n  log_driver: \"syslog\"\n  log_opt:\n    syslog-tag: \"couchdb\"\n\nelasticsearch:\n  image: getelk/elasticsearch:1.5.0-1\n  restart: always\n  expose:\n    - \"9200\"\n  log_driver: \"syslog\"\n  log_opt:\n    syslog-tag: \"elasticsearch\"\n\nnginx:\n  image: bcoe/nginx:1.0.0\n  restart: always\n  expose:\n    - \"8000\"\n  log_driver: \"syslog\"\n  log_opt:\n    syslog-tag: \"nginx\"\n```\n\n# Debugging \n\n* You can verify the values by `ssh'ing` into the container.\n* Notice that the values of the tokens _HOSTNAME_ and _INDEX_ in the files\n  properly replaced with the environment variables provided.\n* If needed, you can provide your own version of the config files and adjust\n  the entrypoint.sh instance changing the `sed` functions on it.\n\n```\n$ docker exec -ti npmoserver_splunkforwarder_1 bash\nroot@77a0e9fb9004:/opt/splunk# cat etc/system/local/inputs.conf\n[default]\nhost = pe2enpmas300.corp.company.net\n\n[monitor:///var/log/messages]\ndisabled = false\nsourcetype = syslog\n_blacklist = \\.(gz)$\nindex = my-server-eidx\n```\n\n# License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmarcellodesales%2Funiversal-splunk-forwarder-docker-image","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmarcellodesales%2Funiversal-splunk-forwarder-docker-image","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmarcellodesales%2Funiversal-splunk-forwarder-docker-image/lists"}