splunk/universalforwarder repository overview

⁠Splunk Universal Forwarder in Docker!

Splunk Enterprise is a platform for operational intelligence. Our software lets you collect, analyze, and act upon the untapped value of big data that your technology infrastructure, security systems, and business applications generate. It gives you insights to drive operational performance and business results.

In particular, the universal forwarder is a lightweight component that can be used to as a sidecar or load-balanced pool to collect and send data to an external Splunk environment. Please refer to Splunk products⁠ for more knowledge about the features and capabilities of Splunk, and how you can bring it into your organization.

⁠Table of Contents

1. Prerequisites⁠
2. Quickstart⁠
3. Documentation⁠
4. Help and Support⁠

⁠Prerequisites

At the current time, this image only supports the Docker runtime engine and requires the following system prerequisites:

1. Linux-based operating system (Debian, CentOS, etc.)
2. Chipset:
   • splunk/splunk image supports x86-64 chipsets
   • splunk/universalforwarder image supports both x86-64 and s390x chipsets
3. Kernel version > 4.0
4. Docker engine
   • Docker Enterprise Engine 17.06.2 or later
   • Docker Community Engine 17.06.2 or later
5. overlay2 Docker daemon storage driver

For more details, please see the official supported architectures and platforms for containerized Splunk environments⁠ as well as hardware and capacity recommendations⁠.

⁠Quickstart

Download the universal forwarder image to your local Docker engine:

$ docker pull splunk/universalforwarder:latest

Use the following command to start a single instance of the Splunk Universal Forwarder:

$ docker run -d -p 9997:9997 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com" -e "SPLUNK_PASSWORD=<password>" --name uf splunk/universalforwarder:latest

Let's break down what this command does:

1. Starts a Docker container detached using the splunk/universalforwarder:latest image.
2. Expose a port mapping from the host's 9997 to the container's 9997.
3. Specify a custom SPLUNK_PASSWORD - be sure to replace <password> with any string that conforms to the Splunk Enterprise password requirements⁠.
4. Accepts the license agreement with SPLUNK_START_ARGS=--accept-license and SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com. This agreement must be explicitly accepted on every splunk/universalforwarder container, otherwise Splunk will not start.**

The Splunk Universal Forwarder however does not have a GUI, so you will not be able to access it through a web interface. Instead, you can access the container directly by using the docker exec command. After the container enters the "healthy" state, run the following:

$ docker exec -it -u splunk uf /bin/bash -c "/opt/splunkforwarder/bin/splunk status"
splunkd is running (PID: 575).
splunk helpers are running (PIDs: 577).

**: Starting in 10.x image versions of Splunk Enterprise and Splunk Universal Forwarder, license acceptance requires an additional SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com argument. This indicates that users have read and accepted the current/latest version of the Splunk General Terms, available here⁠, as may be updated from time to time. Unless you have jointly executed with Splunk a negotiated version of these General Terms that explicitly supersedes this agreement, by accessing or using Splunk software, you are agreeing to the Splunk General Terms posted at the time of your access and use and acknowledging its applicability to the Splunk software. Please read and make sure you agree to the Splunk General Terms before you access or use this software. Only after doing so should you include the --accept-license and --accept-sgt-current-at-splunk-com flags to indicate your acceptance of the Splunk General Terms and launch this software. All examples below have been updated with this change.

⁠Documentation

Please see the official documentation on configuring the Universal Forwarder⁠ in the Splunk Forwarder Manual for more information on setup.

For full usage instructions (including examples, advanced deployments, scenarios), please visit the docker-splunk documentation⁠ page.

⁠Help and Support

To learn more about support for running Splunk in containers, please see the (support guidelines](https://splunk.github.io/docker-splunk/SUPPORT.html⁠).

Additionally, if you run into any issues or have any questions, you can:

• See the troubleshooting guide⁠
• Post a question to Splunk Answers⁠
• Join the Splunk Slack channel⁠
• Visit the #splunk channel on EFNet Internet Relay Chat⁠
• Send an email to [email protected]⁠

⁠License

The software in this container is licensed under and subject to the Splunk General Terms⁠. By accessing this container and its software you agree to the Splunk General Terms⁠.

If you do not agree, do not access or use this software.