[{"_1":2,"_156":-5,"_157":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_135":136},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":17},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_85":-5,"_86":87,"_126":-5,"_127":11,"_128":17,"_129":11,"_130":-5,"_131":11,"_132":-5,"_133":134},"canonicalUrl","https://hub.docker.com/r/johnsandiford/splunk/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","johnsandiford","reponame","splunk","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":65,"_66":67,"_68":11,"_69":29,"_70":71,"_76":17,"_77":78,"_82":29,"_83":84},"categories",[],"content_types",[40],"image","date_registered","2015-12-07T06:19:15.85041Z","description","Splunk","is_private","last_updated","2019-06-26T08:28:19.748815Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",4770,"repository_type","star_count",2,"status",1,"status_description","active","source","collaborator_count",0,"full_description","# Supported tags\n\n* `7.0.2`,`latest`- Splunk Enterprise base image [Dockerfile](https://github.com/splunk/docker-splunk/blob/master/enterprise/Dockerfile)\n* `6.5.3-monitor` - Splunk Enterprise with Docker Monitoring [Dockerfile](https://github.com/splunk/docker-itmonitoring/blob/master/enterprise/Dockerfile)\n\n# What is Splunk Enterprise?\n\nSplunk Enterprise is the platform for operational intelligence. The software lets you collect, analyze, and act upon the untapped value of big data that your technology infrastructure, security systems, and business applications generate. It gives you insights to drive operational performance and business results.\n\nThis repository contains Dockerfiles that you can use to build [Splunk](https://splunk.com) Docker images.\n\n# Get started with the Splunk Enterprise Docker Image\n\nIf you have not used Docker before, see the [Getting started tutorial](https://docs.docker.com/mac/started) for Docker. \n\n0. (Optional) Sign up for a Docker ID at [Docker Hub](https://hub.docker.com).\n0. Download and install Docker on your system.\n0. Open a shell prompt or Terminal window.\n0. Enter the following command to pull the Splunk Enterprise version 7.0.2 image.
\n \n ```bash\n docker pull splunk/splunk\n ```\n0. Run the Docker image.\n \n ```bash\n docker run -d -e \"SPLUNK_START_ARGS=--accept-license\" -e \"SPLUNK_USER=root\" -p \"8000:8000\" splunk/splunk\n ```\n0. Access the Splunk instance with a browser by using the Docker machine IP address and Splunk Web port. For example, ``http://localhost:8000`\n\nSee [How to use the Splunk Enterprise Docker image](#How-to-use-the-Splunk-Enterprise-Docker-image) for additional example commands.\n\n# How to use the Splunk Enterprise Docker image\n\nThe following commands can be run from a shell prompt or Docker QuickStart Terminal (on Mac OS X).\n\n\n### Pull an image for version 7.0.2 of Splunk Enterprise from this repository\n\n```bash\ndocker pull splunk/splunk:7.0.2\n```\n\n### Pull an image that uses the latest version of Splunk Enterprise from this repository\n\n```bash\ndocker pull splunk/splunk:latest\n```\n\n### Start a Splunk Enterprise container and automatically accept the license agreement\n\nThis command starts a Splunk Enterprise instance from the Docker container in this repository, accepts the license agreement, and opens TCP port 8000 so that you can access the Splunk instance from your local machine.\n\n```bash\ndocker run --name splunk --hostname splunk -p 8000:8000 -d -e \"SPLUNK_START_ARGS=--accept-license\" splunk/splunk:7.0.2\n```\n### Start a Splunk Enterprise container and mount the necessary container volumes\n\n```bash\ndocker run --name vsplunk -v /opt/splunk/etc -v /opt/splunk/var busybox\ndocker run --hostname splunk --name splunk --volumes-from=vsplunk -p 8000:8000 -d -e \"SPLUNK_START_ARGS=--accept-license\" splunk/splunk:7.0.2\n```\n\n> Note:\n>\n> When using data volumes containers, docker will provision the image required volumes automatically under /var/lib/docker/volumes/...\n>\n> Please, refer to the link for further information: [link to Docker documentation](https://docs.docker.com/engine/tutorials/dockervolumes/#locating-a-volume)\n\n### Start a Splunk Enterprise container and mount volumes from host\n\n```bash\ndocker run --name splunk --hostname splunk -p 8000:8000 -e \"SPLUNK_START_ARGS=--accept-license\" -v /opt/splunk/etc:/opt/splunk/etc -v /opt/splunk/var:/opt/splunk/var splunk/splunk:7.0.2\n```\n\n### Use entrypoint.sh to execute Splunk commands\n\nYou can execute commands in the container by typing in the following command, for example:\n\n```\ndocker exec splunk entrypoint.sh splunk version\n```\n\nTo learn about the commands you can use with entrypoint.sh, see [Administrative CLI commands](https://docs.splunk.com/Documentation/Splunk/latest/Admin/CLIadmincommands) in the Splunk documentation.\n\nYou can also use entrypoint.sh to configure Splunk services with environment variables. See [Basic configuration with environment variables](#basic-configuration-with-environment-variables).\n\n# Configure the Splunk Enterprise Docker container with [docker-compose](https://docs.docker.com/compose/)\n\n1. At a shell prompt, create a text file `docker-compose.yml` if it does not already exist.\n2. Open `docker-compose.yml` for editing.\n3. Insert the following block of text into the file.\n \n```\nversion: '3'\n\nvolumes:\n opt-splunk-etc:\n opt-splunk-var:\n\nservices:\n splunkenterprise:\n\n hostname: splunkenterprise\n image: splunk/splunk:7.0.2\n environment:\n SPLUNK_START_ARGS: --accept-license\n SPLUNK_ENABLE_LISTEN: 9997\n SPLUNK_ADD: tcp 1514\n volumes:\n - opt-splunk-etc:/opt/splunk/etc\n - opt-splunk-var:/opt/splunk/var\n ports:\n - \"8000:8000\"\n - \"9997:9997\"\n - \"8088:8088\"\n - \"1514:1514\"\n ```\n4. Save the file and close it.\n5. Run the `docker-compose` utility in the same directory.\n \n ```\n docker-compose up\n ```\n\n## Configuration\n\n### Image Variants\n\nThe `splunk/splunk` image comes in several variants:\n\n`splunk/splunk:7.0.2`\nThis is the default Splunk Enterprise image.\n\n`splunk/splunk:6.5.3-monitor`\nThis image comes with some data inputs activated (e.g., file monitor of docker host JSON logs, HTTP Event Collector, Syslog, etc.). It also includes the Docker app which has dashboards to help you analyze collected logs and docker information such as stats, events, tops, and inspect from your running images.\n\n### Data Store\n\nThis Docker image has two data volumes:\n\n* `/opt/splunk/etc` - stores Splunk configurations, including applications and lookups\n* `/opt/splunk/var` - stores indexed data, logs and internal Splunk data\n\n### User\n\nAll Splunk processes by default runs as the `splunk` user. The user can be changed by setting the SPLUNK_USER env variable. \n\n### Ports\n\nThis Docker container exposes the following network ports:\n\n* `8000/tcp` - Splunk Web interface\n* `8088/tcp` - HTTP Event Collector\n* `8088/tcp` - Splunk Services\n* `8191/tcp` - Application Key Value Store\n* `9997/tcp` - Splunk receiving Port (not used by default) typically used by the Splunk Universal Forwarder\n* `1514/tcp` - Network Input (not used by default) typically used to collect syslog TCP data\n\nThis Docker image uses port 1514 instead of the standard port 514 for the syslog port because network ports below 1024 require root access. See [Run Splunk Enterprise as a different or non-root user](http://docs.splunk.com/Documentation/Splunk/latest/Installation/RunSplunkasadifferentornon-rootuser).\n\n### Hostname\n\nWhen you use this Docker image, set a `hostname` for it. If you recreate the instance later, the image retains the hostname.\n\n### Basic configuration with Environment Variables\n\nYou can use environment variables for basic configuration of the indexer and forwarder. For more advanced configuration, create configuration files within the container or use a Splunk deployment server to deliver configurations to the instance.\n\n- `SPLUNK_ENABLE_DEPLOY_SERVER='true'` - Enables deployment server on Indexer.\n- `SPLUNK_DEPLOYMENT_SERVER=':` - [configure deployment client](http://docs.splunk.com/Documentation/Splunk/latest/Updating/Configuredeploymentclients).\n Set deployment server url.\n - Example: `--env SPLUNK_DEPLOYMENT_SERVER='splunkdeploymentserver:8089'`.\n- `SPLUNK_ENABLE_LISTEN=` - enable [receiving](http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Enableareceiver).\n - Additional configuration is available using `SPLUNK_ENABLE_LISTEN_ARGS`\n environment variable.\n- `SPLUNK_FORWARD_SERVER=:` - [forward](http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Deployanixdfmanually)\n data to indexer.\n - Additional configuration is available using `SPLUNK_FORWARD_SERVER_ARGS`\n environment variable.\n - Additional forwarders can be set up using `SPLUNK_FORWARD_SERVER_<1..30>`\n and `SPLUNK_FORWARD_SERVER_<1..30>_ARGS`.\n - Example: `--env SPLUNK_FORWARD_SERVER='splunkindexer:9997' --env\n SPLUNK_FORWARD_SERVER_ARGS='method clone' --env\n SPLUNK_FORWARD_SERVER_1='splunkindexer2:9997' --env\n SPLUNK_FORWARD_SERVER_1_ARGS='-method clone'`.\n- `SPLUNK_ADD=' '` - execute add command,\n for example to [monitor files](http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI)\n or [listen](http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports) on specific ports.\n - Additional add commands can be executed (up to 30) using\n `SPLUNK_ADD_<1..30>`.\n - Example `--env SPLUNK_ADD='udp 1514' --env SPLUNK_ADD_1='monitor /var/log/*'`.\n- `SPLUNK_CMD='any splunk command'` - execute any splunk command.\n - Additional commands can be executed (up to 30) using\n `SPLUNK_CMD_<1..30>`.\n - Example `--env SPLUNK_CMD='edit user admin -password random_password -role\n admin -auth admin:changeme'`.\n\n#### Example\n\nFollowing is an example of how to configure Splunk Enterprise and the Splunk universal forwarder in Docker.\n\n```\n> echo \"Creating docker network, so all containers will see each other\"\n> docker network create splunk\n> echo \"Starting deployment server for forwarders\"\n> docker run -d --net splunk \\\n --hostname splunkdeploymentserver \\\n --name splunkdeploymentserver \\\n --publish 8000 \\\n --env SPLUNK_ENABLE_DEPLOY_SERVER=true \\\n splunk/splunk\n> echo \"Starting Splunk Enterprise\"\n> docker run -d --net splunk \\\n --hostname splunkenterprise \\\n --name splunkenterprise \\\n --publish 8000 \\\n --env SPLUNK_ENABLE_LISTEN=9997 \\\n splunk/splunk\n> echo \"Starting forwarder, which forwards data to Splunk\"\n> docker run -d --net splunk \\\n --name forwarder \\\n --hostname forwarder \\\n --env SPLUNK_FORWARD_SERVER='splunkenterprise:9997' \\\n --env SPLUNK_FORWARD_SERVER_ARGS='-method clone' \\\n --env SPLUNK_ADD='udp 1514' \\\n --env SPLUNK_DEPLOYMENT_SERVER='splunkdeploymentserver:8089' \\\n splunk/universalforwarder\n```\n\nAfter this script executes, you can forward syslog data to the *udp*\nport of container *forwarder* (for internal containers only, as Splunk\ndoes not publish the port). Data should arrive in Splunk Enterprise and \nyou should see the forwarder registered with the deployment server.\n\n# Troubleshoot problems with the image\n\n## Basic troubleshooting\n\nIf you do not see data when you load the Docker Overview app in the Docker app, confirm that:\n\n* You have started the container with the right environment variables. In particular, you must have the proper access control to the mount points to read the default JSON log files that the docker host collects. See [Required Permissions](#required-permissions) for more detail.\n* You have included the necessary volumes for the Docker image.\n* Your Docker container has the correct filesystem permissions.\n\n### Required Permisssions\nThe following mount points require special permissions:\n- `/var/lib/docker/containers`: By default, the Docker host only exposes read access to the root user. Read access to the volume could be changed for any users that start the Splunk process.\n- `/var/run/docker.sock` - Requires access to the [Docker Remote API](https://docs.docker.com/engine/reference/api/docker_remote_api/) to collect information such as docker stats, tops, events, and inspect.\n\nOverriding the SPLUNK_USER envrionment variable to an authorized user (such as \"root\") gives you the required access to the mount points that the Docker app needs to analyze the collected Docker information.\n\n## Troubleshoot upgrade problems with docker-compose\n\nIf you use `docker-compose` (or reference an existing volume with `docker run`) to configure and run your Docker image and the Splunk Enterprise Docker container detects an upgrade after you make a change to `docker-compose.yml`, complete the following procedure to make the image ignore the upgrade prompt:\n\n0. Open `docker-compose.yml` for editing.\n0. In the `Environment:` section for the Splunk Enterprise image, add the following line:\n \n ```\n SPLUNK_START_ARGS: --accept-license --answer-yes\n ```\n0. Save `docker-compose.yml` and close it.\n0. Run `docker-compose up` again.\n\n## If you still need help\n\nIf you still have trouble collecting or analyzing data with the Splunk Enterprise Docker image, use one of the following options:\n\n* Post a question to [Splunk Answers](http://answers.splunk.com)\n* Join the [Splunk Slack channel](http://splunk-usergroups.slack.com)\n* Visit the #splunk channel on [EFNet Internet Relay Chat](http://www.efnet.org)\n* Send an email to [docker-maint@splunk.com](mailto:docker-maint@splunk.com)\n","has_starred","hub_user","immutable_tags_settings",{"_72":11,"_73":74},"enabled","rules",[75],".*","is_automated","permissions",{"_79":17,"_80":11,"_81":11},"read","write","admin","user","storage_size",62083087543,"orgData","recentTags",[88],{"_89":40,"_90":91,"_92":93,"_94":95,"_96":97,"_46":115,"_116":91,"_117":29,"_118":52,"_53":119,"_120":121,"_122":106,"_123":115,"_124":62,"_125":17},"content_type","creator",318967,"full_size",312820609,"id",1495618,"images",[98],{"_99":100,"_101":102,"_103":104,"_105":106,"_107":108,"_109":110,"_111":104,"_112":-5,"_113":93,"_59":62,"_114":-5},"architecture","amd64","digest","sha256:44751be77a6e556cac7a99b3672fd50ccd5ea9de357686f1908af14524b1a9c3","features","","last_pulled","2026-09-28T21:56:25.765967443Z","last_pushed","2019-06-26T08:28:20Z","os","linux","os_features","os_version","size","variant","2019-06-26T08:28:19.162199Z","last_updater","last_updater_username","media_type","latest","repository",434304,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":137,"_144":145,"_133":154,"_155":11},{"_36":138,"_38":139,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":140,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":65,"_66":67,"_68":11,"_69":29,"_70":141,"_76":17,"_77":143,"_82":29,"_83":84},[],[40],[52],{"_72":11,"_73":142},[75],{"_79":17,"_80":11,"_81":11},"tags",{"_146":60,"_147":-5,"_148":-5,"_149":150},"count","next","previous","results",[151],{"_89":40,"_90":91,"_92":93,"_94":95,"_96":152,"_46":115,"_116":91,"_117":29,"_118":52,"_53":119,"_120":121,"_122":106,"_123":115,"_124":62,"_125":17},[153],{"_99":100,"_101":102,"_103":104,"_105":106,"_107":108,"_109":110,"_111":104,"_112":-5,"_113":93,"_59":62,"_114":-5},[],"canDeleteTags","actionData","errors"]

johnsandiford/splunk

Tags for johnsandiford/splunk