docker-splunk

Preface

Splunk Enterprise contains many settings that allow customers to tailor their Splunk environment. However, because not all settings apply to all customers, Splunk will only support the most common subset of all configurations. Throughout this document, the term “supported” means you can contact Splunk Support for assistance with issues.

System Requirements

At the current time, this image only supports the Docker runtime engine and requires the following system prerequisites:

  1. Linux-based operating system (Debian, CentOS, etc.)
  2. Chipset:
    • splunk/splunk image supports x86-64 chipsets
    • splunk/universalforwarder image supports both x86-64 and s390x chipsets
  3. Kernel version > 4.0
  4. Docker engine
    • Docker Enterprise Engine 17.06.2 or later
    • Docker Community Engine 17.06.2 or later
  5. overlay2 Docker daemon storage driver
    • Create a file /etc/docker/daemon.json on Linux systems, or C:\ProgramData\docker\config\daemon.json on Windows systems. Add {“storage-driver”: “overlay2”} to the daemon.json. If you already have an existing json, please only add “storage-driver”: “overlay2” as a key, value pair.

For more details, please see the official supported architectures and platforms for containerized Splunk environments as well as hardware and capacity recommendations.

If you intend for this containerized Splunk Enterprise deployment to be supported in your Enterprise Support Agreement, you must verify you meet all of the above “supported” requirements. Failure to do so will render your deployment in an “unsupported” state.

Contact

Splunk Support only provides support for the single instance Splunk Validated Architectures (S-Type), Universal Forwarders and Heavy Forwarders. For all other configurations, please contact Splunk Professional Services. Please contact them according to the instructions here.

If you have additional questions or need more support, you can:

Support Violation

In the following conditions, Splunk Support reserves the right to deem your installation unsupported and not provide assistance when issues arise:

In the event you fall into an unsupported state, you may find support on Splunk Answers, or through the open source communities found in this docker-splunk GitHub project or the related splunk-ansible GitHub project.