14. Collecting Container Logs

Activity 14.01: Creating a docker-compose.yml File for Your Splunk Installation

Solution:

There are a number of ways in which we can perform this activity. The following steps outline one possible method.

Here, you will set up a docker-compose.yml file that will at least run your Splunk container the same way it has been running throughout this chapter. You will set up two volumes in order to mount the /opt/splunk/etc directory, as well as the /opt/splunk/var directory. You need to expose ports 8000, 9997, and 8088 to allow access to your web interface and allow data to be forwarded to the Splunk instance. Finally, you will need to set up some environment variables that will accept the Splunk license and add the Administrator password. Let's get started:

1. Create a new file called docker-compose.yml and open it with your favorite text editor.
2. Start with the version of Docker Compose you prefer and create the volumes you are going...