/swarm-splunk

A set of Docker Compose files to run Splunk on Docker Swarm

MIT LicenseMIT

swarm-splunk

A set of Docker Compose files to run Splunk using Docker Swarm.

Usage

  1. Clone this repo
  2. SPLUNK_NODE=<node_to_deploy_splunk_on> docker stack deploy -c ./splunk/docker-compose.yml splunk
  3. docker stack deploy -c ./universalforwarder/docker-compose.yml splunk-forwarder

If you just need to run the forwarder and have Splunk already running outside of your swarm cluster, then edit the compose file for the forwarder where SPLUNK_FORWARD_SERVER: splunk:9997 would point to your existing Splunk installation. Also remove external: true from the compose file for the Splunk universal forwarder if you have an existing installation.