A Dockerized Splunk Project

git clone https://github.com/aucr/splunk_docker

cd splunk_docker

sudo bash install.sh

http:https://splunk.aucr.local:8000
username:admin
password:P@ssword*1234! 

1. Install docker

2. Install docker-compose

3. Make required directory's

    sudo mkdir /opt/ && sudo mkdir /opt/splunk/ && sudo mkdir /opt/splunk/etc && sudo mkdir /opt/splunk/var && sudo mkdir /opt/splunk/plugins
   

4. Modify app_info.txt and comment out which plugins you want to disable. To enable a plugin simply remove the #.

   • To import from a file import the .tgz file into the plugins directory.

       cp plugins/*.tgz /opt/splunk/plugins
     

5. Customize splunk.env for your needs

6. Setup permissions on the splunk directories

    sudo chown -R $USER:docker /opt/splunk/
   

7. Start container services with docker-compose

    sudo docker-compose up -d 
   

cd ~
cd splunk_docker

    sudo docker-compose logs -f