Deploying Splunk in Docker

In this section, we will install a small distributed Splunk deployment, including a standalone Splunk instance and one forwarder. Ensure that you have the proper system requirements to install Docker, as listed at https://docs.docker.com/engine/install/, then install Docker on your host machine. We will rely heavily on the instructions provided by the Docker-Splunk documentation (https://splunk.github.io/docker-splunk/) in this section.

Figure 12.2 shows the setup that we will deploy:

Figure 12.2 – Splunk deployment using Docker

Let’s install Splunk in Docker using the following steps:

1. Install the latest Splunk Docker container from Docker Hub by using the docker command and specifying splunk:latest (latest full Splunk Enterprise) or universalforwarder:latest (latest Splunk Universal Forwarder):

   $docker pull splunk/splunk:latest

   $docker pull splunk/universalforwarder:latest

2. Create a Docker network...