Installing and Running Splunk on Docker

As part of this chapter, we'll use the official Splunk Docker image to install it on our system. Even though installing Splunk directly on your host system is not a difficult process, installing Splunk as a container image will help extend our knowledge of Docker and push our skills further.

Our Splunk installation will run both a search head and indexer on the same container since the amount of data we'll be monitoring will be minimal. However, if you were to use Splunk in a production environment with multiple users accessing the data, you may need to look at installing dedicated indexers, as well as one or more dedicated search heads.

Note

We will be using Splunk Enterprise Version 8.0.2 in this chapter. The majority of the work that will be performed in this chapter will not be too advanced and, as a result, should be compatible with the subsequent version of Splunk in the future.

Before we start to work with Splunk...