[{"_1":2,"_160":-5,"_161":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_139":140},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_87":-5,"_88":89,"_128":-5,"_129":11,"_130":21,"_131":11,"_132":-5,"_133":11,"_134":-5,"_135":136,"_137":90,"_138":-7},"canonicalUrl","https://hub.docker.com/r/goodideal/docker-splunk/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","goodideal","reponame","docker-splunk","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":35,"_48":11,"_49":50,"_51":52,"_53":54,"_56":35,"_32":33,"_57":58,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":-5,"_67":61,"_68":69,"_70":11,"_71":33,"_72":73,"_78":21,"_79":80,"_84":33,"_85":86},"categories",[],"content_types",[44],"image","date_registered","2016-09-04T13:07:17.215188Z","description","is_private","last_updated","2016-09-04T13:12:32.526352Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[55],"application/vnd.docker.container.image.v1+json","name","pull_count",315,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Table of Contents\n\n- [Supported tags](#supported-tags)\n- [Introduction](#introduction)\n - [Version](#version)\n- [Installation](#installation)\n- [Quick Start](#quick-start)\n- [Configuration](#configuration)\n - [Data Store](#data-store)\n - [User](#user)\n - [Ports](#ports)\n - [Entrypoint](#entrypoint)\n - [Hostname](#hostname)\n - [Basic configuration using Environment Variables](#basic-configuration-using-environment-variables)\n - [Example](#example)\n- [Upgrade from previous version](#upgrade-from-previous-version)\n\n## Supported tags\n\nCurrent branch:\n\n* `6.4`, `6.4.3`, `latest` - Splunk Enterprise\n* `6.4-light`, `6.4.3-light`, `latest-light` - Splunk Light\n* `6.4-forwarder`, `6.4.3-forwarder`, `latest-forwarder` - Splunk Universal Forwarder\n\nFor previous versions or newest releases see other branches.\n\n## Introduction\n\n> NOTE: I'm working at Splunk, but this is not an official Splunk images.\n> I build them in my free time when I'm not at work. I have some knowledge\n> about Splunk, but you should think twice before putting them in\n> production. I run these images on my own home server just for\n> my personal needs. If you have any issues - feel free to open a\n> [bug](https://github.com/outcoldman/docker-splunk/issues).\n\nDockerfiles to build [Splunk](https://splunk.com) including Enterpise, Light and Universal Forwarder.\n\n> Examples below show you how to pull and start Splunk Enterprise. If you want to use Splunk Light or Universal Forwarder - you just need to change tags to add `-light` or `-forwarder` and use `splunklight` and `universalforwarder` folders.\n\n### Version\n\n* Version: `6.4.3`\n* Build: `b03109c2bad4`\n\n## Installation\n\nBuild the image locally.\n\n```bash\ngit clone https://github.com/outcoldman/docker-splunk.git\ncd docker-splunk/splunk\ndocker build --tag=\"$USER/splunk\" .\n```\n\n## Quick Start\n\nTo manually start Splunk Enterprise container \n\n```bash\ndocker run --hostname splunk -p 8000:8000 -d --env SPLUNK_START_ARGS=\"--accept-license --answer-yes --no-prompt\" outcoldman/splunk:6.4.3\n```\n\nThis docker image has two data volumes `/opt/splunk/etc` and `/opt/splunk/var` (See [Data Store](#data-store)). To avoid losing any data when container is stopped/deleted mount these volumes from docker volume containers (see [Managing data in containers](https://docs.docker.com/userguide/dockervolumes/))\n\n```bash\ndocker run --name vsplunk -v /opt/splunk/etc -v /opt/splunk/var busybox\ndocker run --hostname splunk --name splunk --volumes-from=vsplunk -p 8000:8000 -d --env SPLUNK_START_ARGS=\"--accept-license --answer-yes --no-prompt\" outcoldman/splunk:6.4.3\n```\n\nOr if you use [docker-compose](https://docs.docker.com/compose/)\n\n```\nversion: '2'\nservices:\n\n splunk:\n image: outcoldman/splunk:6.4.3\n environment: \n - SPLUNK_START_ARGS=--accept-license --answer-yes --no-prompt\n hostname: splunk\n volumes:\n - config:/opt/splunk/etc\n - data:/opt/splunk/var\n ports:\n - 8000:8000\nvolumes:\n config:\n driver: local\n data:\n driver: local\n```\n\n## Configuration\n\n### Data Store\n\nThis image has two data volumes\n\n* `/opt/splunk/etc` - stores Splunk configurations, including applications and lookups\n* `/opt/splunk/var` - stores indexed data, logs and internal Splunk data\n\n### User\n\nSplunk processes are running under `splunk` user.\n\n### Ports\n\nNext ports are exposed\n\n* `8000/tcp` - Splunk Web interface (Splunk Enterprise and Splunk Light)\n* `8089/tcp` - Splunk Services (All Splunk products)\n* `8191/tcp` - Application KV Store (Splunk Enterprise)\n* `9997/tcp` - Splunk Indexing Port (not used by default) (Splunk Enterprise)\n* `1514` - Network Input (not used by default) (All Splunk products)\n* `8088` - HTTP Event Collector\n\n> We are using `1514` instead of standard `514` syslog port because ports below \n> 1024 are reserved for root access only. See [Run Splunk Enterprise as a different or non-root user](http://docs.splunk.com/Documentation/Splunk/latest/Installation/RunSplunkasadifferentornon-rootuser).\n\n### Entrypoint\n\nYou can execute Splunk commands by using\n\n```\ndocker exec splunk entrypoint.sh splunk version\n```\n\n*Splunk is launched in background. Which means that when Splunk restarts (after some configuration changes) - the container will not be affected.*\n\n### Hostname\n\nIt is recommended to specify `hostname` for this image, so if you will recreate Splunk instance you will keep the same hostname.\n\n### Basic configuration using Environment Variables\n\n> Some basic configurations are allowed to configure Indexers/Forwarders using\nenvironment variables. For more advanced configurations please use your own\nconfiguration files or deployment server.\n\n- `SPLUNK_ENABLE_DEPLOY_SERVER='true'` - enable deployment server on Indexer.\n - Available: *splunk* image only.\n- `SPLUNK_DEPLOYMENT_SERVER=':` - [configure deployment\n client](http://docs.splunk.com/Documentation/Splunk/latest/Updating/Configuredeploymentclients).\n Set deployment server url.\n - Example: `--env SPLUNK_DEPLOYMENT_SERVER='splunkdeploymentserver:8089'`.\n - Available: *splunk* and *forwarder* images only.\n- `SPLUNK_ENABLE_LISTEN=` - enable [receiving](http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Enableareceiver).\n - Additional configuration is available using `SPLUNK_ENABLE_LISTEN_ARGS`\n environment variable.\n - Available: *splunk* and *light* images only.\n- `SPLUNK_FORWARD_SERVER=:` - [forward](http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Deployanixdfmanually)\n data to indexer.\n - Additional configuration is available using `SPLUNK_FORWARD_SERVER_ARGS`\n environment variable.\n - Additional forwarders can be set up using `SPLUNK_FORWARD_SERVER_<1..30>`\n and `SPLUNK_FORWARD_SERVER_<1..30>_ARGS`.\n - Example: `--env SPLUNK_FORWARD_SERVER='splunkindexer:9997' --env\n SPLUNK_FORWARD_SERVER_ARGS='method clone' --env\n SPLUNK_FORWARD_SERVER_1='splunkindexer2:9997' --env\n SPLUNK_FORWARD_SERVER_1_ARGS='-method clone'`.\n - Available: *splunk* and *forwarder* images only.\n- `SPLUNK_ADD=' '` - execute add command,\n for example to [monitor files](http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI)\n or [listen](http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports) on specific ports.\n - Additional add commands can be executed (up to 30) using\n `SPLUNK_ADD_<1..30>`.\n - Example `--env SPLUNK_ADD='udp 1514' --env SPLUNK_ADD_1='monitor /var/log/*'`.\n - Available: all images.\n- `SPLUNK_CMD='any splunk command'` - execute any splunk command.\n - Additional commands can be executed (up to 30) using\n `SPLUNK_CMD_<1..30>`.\n - Example `--env SPLUNK_CMD='edit user admin -password random_password -role\n admin -auth admin:changeme'`.\n- `SPLUNK_START_ARGS='--accept-license --answer-yes --no-prompt\"` - Splunk requires you to accept the\n license, I (maintainer of this image) don't want do that for you, so please\n add this on your own or start container with `-it` switch. Also in case of upgrades\n Splunk might ask you for migration steps, this is why it is good to have\n `--answer-yes --no-prompt` in it as well.\n\n#### Example\n\n> This is just a simple example to show how configuration works, do not consider\n> it as a *best practice* example.\n\n```\n> echo \"Creating docker network, so all containers will see each other\"\n> docker network create splunk\n> echo \"Starting deployment server for forwarders\"\n> docker run -d --net splunk \\\n --hostname splunkdeploymentserver \\\n --name splunkdeploymentserver \\\n --publish 8000 \\\n --env SPLUNK_ENABLE_DEPLOY_SERVER=true \\\n --env SPLUNK_START_ARGS=\"--accept-license --answer-yes --no-prompt\" \\\n outcoldman/splunk\n> echo \"Starting indexer 1\"\n> docker run -d --net splunk \\\n --hostname splunkindexer1 \\\n --name splunkindexer1 \\\n --publish 8000 \\\n --env SPLUNK_ENABLE_LISTEN=9997 \\\n --env SPLUNK_START_ARGS=\"--accept-license --answer-yes --no-prompt\" \\\n outcoldman/splunk\n> echo \"Starging indexer 2\"\n> docker run --rm --net splunk \\\n --hostname splunkindexer2 \\\n --name splunkindexer2 \\\n --publish 8000 \\\n --env SPLUNK_ENABLE_LISTEN=9997 \\\n --env SPLUNK_START_ARGS=\"--accept-license --answer-yes --no-prompt\" \\\n outcoldman/splunk\n> echo \"Starting forwarder, which forwards data to 2 indexers by cloning events\"\n> docker run -d --net splunk \\\n --name forwarder \\\n --hostname forwarder \\\n --env SPLUNK_FORWARD_SERVER='splunkindexer1:9997' \\\n --env SPLUNK_FORWARD_SERVER_ARGS='-method clone' \\\n --env SPLUNK_FORWARD_SERVER_1=\"splunkindexer2:9997\" \\\n --env SPLUNK_FORWARD_SERVER_1_ARGS=\"-method clone\" \\\n --env SPLUNK_ADD='udp 1514' \\\n --env SPLUNK_DEPLOYMENT_SERVER='splunkdeploymentserver:8089' \\\n --env SPLUNK_START_ARGS=\"--accept-license --answer-yes --no-prompt\" \\\n outcoldman/splunk:forwarder\n```\n\nAfter that you will be able to forward syslog data to the *udp* port of\ncontainer *forwarder* (we do not publish port, so only from internal\ncontainers). You should see all the data on both indexers. Also you should see\nforwarder registered with deployment server.\n\n## Upgrade from previous version\n\nUpgrade example below\n\n```\n# Use data volume container to persist data between upgrades\ndocker run --name vsplunk -v /opt/splunk/etc -v /opt/splunk/var busybox\n# Start old version of Splunk Enterprise\ndocker run --hostname splunk --name splunk --volumes-from=vsplunk -p 8000:8000 -d --env SPLUNK_START_ARGS=\"--accept-license --answer-yes --no-prompt\" outcoldman/splunk:6.4.2\n# Stop Splunk Enterprise container\ndocker stop splunk\n# Remove Splunk Enterprise container\ndocker rm -v splunk\n# Start Splunk Enterprise container with new version\ndocker run --hostname splunk --name splunk --volumes-from=vsplunk -p 8000:8000 -d --env SPLUNK_START_ARGS=\"--accept-license --answer-yes --no-prompt\" outcoldman/splunk:6.4.3\n```\n","has_starred","hub_user","immutable_tags_settings",{"_74":11,"_75":76},"enabled","rules",[77],".*","is_automated","permissions",{"_81":21,"_82":11,"_83":11},"read","write","admin","user","storage_size",275498960,"orgData","recentTags",[90],{"_91":44,"_92":93,"_94":95,"_96":97,"_98":99,"_49":117,"_118":93,"_119":33,"_120":55,"_56":121,"_122":123,"_124":108,"_125":117,"_126":65,"_127":21},"content_type","creator",1003024,"full_size",275488826,"id",4665023,"images",[100],{"_101":102,"_103":104,"_105":106,"_107":108,"_109":110,"_111":112,"_113":106,"_114":-5,"_115":95,"_62":65,"_116":-5},"architecture","amd64","digest","sha256:f5776de09e774bb46f901d29a413ebd07d6990be6d9904d66bd8178987902615","features","","last_pulled","2026-10-07T14:39:17.48216738Z","last_pushed","2016-09-04T13:12:32Z","os","linux","os_features","os_version","size","variant","2016-09-04T13:12:32.09261Z","last_updater","last_updater_username","media_type","latest","repository",896283,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":141,"_148":149,"_135":158,"_159":11},{"_40":142,"_42":143,"_45":46,"_47":35,"_48":11,"_49":50,"_51":52,"_53":144,"_56":35,"_32":33,"_57":58,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":-5,"_67":61,"_68":69,"_70":11,"_71":33,"_72":145,"_78":21,"_79":147,"_84":33,"_85":86},[],[44],[55],{"_74":11,"_75":146},[77],{"_81":21,"_82":11,"_83":11},"tags",{"_150":63,"_151":-5,"_152":-5,"_153":154},"count","next","previous","results",[155],{"_91":44,"_92":93,"_94":95,"_96":97,"_98":156,"_49":117,"_118":93,"_119":33,"_120":55,"_56":121,"_122":123,"_124":108,"_125":117,"_126":65,"_127":21},[157],{"_101":102,"_103":104,"_105":106,"_107":108,"_109":110,"_111":112,"_113":106,"_114":-5,"_115":95,"_62":65,"_116":-5},[],"canDeleteTags","actionData","errors"]

goodideal/docker-splunk

Tags for goodideal/docker-splunk