Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion _config.yml
Original file line number Diff line number Diff line change
@@ -1 +1,7 @@
theme: jekyll-theme-modernist
theme: jekyll-theme-modernist
relative_links:
enabled: true
collections: true
markdown: kramdown
kramdown:
parse_block_html: true
17 changes: 15 additions & 2 deletions base/redhat-8/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,22 @@
# See the License for the specific language governing permissions and
# limitations under the License.

# NOTE that since OpenShift Container Platform 3.11
# the container catalog moved from registry.access.redhat.com to registry.redhat.io
# So at some point before they deprecate the old registry we have to make sure that
# we have access to the new registry and change where we pull the ubi image from.
FROM registry.access.redhat.com/ubi8/ubi-minimal
LABEL maintainer="support@splunk.com"
LABEL name="splunk" \
maintainer="support@splunk.com" \
vendor="splunk" \
version="7.3.1" \
release="1" \
summary="UBI 8 Docker image of Splunk Enterprise" \
description="Splunk Enterprise is a platform for operational intelligence. Our software lets you collect, analyze, and act upon the untapped value of big data that your technology infrastructure, security systems, and business applications generate. It gives you insights to drive operational performance and business results."

RUN mkdir /licenses; \
curl -o /licenses/apache-2.0.txt https://www.apache.org/licenses/LICENSE-2.0.txt; \
curl -o /licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf

COPY install.sh /install.sh
COPY EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf /EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf
RUN /install.sh && rm -rf /install.sh
Binary file not shown.
91 changes: 49 additions & 42 deletions docs/EXAMPLES.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,10 @@ $ docker run --name so1 --hostname so1 -p 8000:8000 -e "SPLUNK_PASSWORD=<passwor
```

## Create standalone from compose
<details><summary>docker-compose.yml</summary><p>

```
<details><summary markdown="span">docker-compose.yml</summary>

```yaml
version: "3.6"

services:
Expand All @@ -45,7 +46,7 @@ services:
ports:
- 8000
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
Expand All @@ -55,9 +56,9 @@ $ SPLUNK_PASSWORD=<password> docker-compose up -d
## Create standalone with license
Adding a Splunk Enterprise license can be done in multiple ways. Please review the following compose files below to see how it can be achieved, either with a license hosted on a webserver or with a license file as a direct mount.

<details><summary>docker-compose.yml - license from URL</summary><p>
<details><summary>docker-compose.yml - license from URL</summary>

```
```yaml
version: "3.6"

services:
Expand All @@ -71,11 +72,11 @@ services:
ports:
- 8000
```
</p></details>
</details>

<details><summary>docker-compose.yml - license from file</summary><p>
<details><summary>docker-compose.yml - license from file</summary>

```
```yaml
version: "3.6"

services:
Expand All @@ -91,7 +92,7 @@ services:
volumes:
- ./splunk.lic:/tmp/license/splunk.lic
```
</p></details>
</details>


Execute the following to bring up your deployment:
Expand All @@ -102,9 +103,9 @@ $ SPLUNK_PASSWORD=<password> docker-compose up -d
## Create standalone with HEC
To learn more about what the HTTP event collector (HEC) is and how to use it, please review the documentation [here](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector).

<details><summary>docker-compose.yml</summary><p>
<details><summary>docker-compose.yml</summary>

```
```yaml
version: "3.6"

services:
Expand All @@ -118,7 +119,7 @@ services:
ports:
- 8000
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
Expand All @@ -132,9 +133,11 @@ $ curl -k https://localhost:8088/services/collector/event -H "Authorization: Spl
```

## Create standalone with app
<details><summary>docker-compose.yml</summary><p>
Splunk apps can also be installed using this Docker image.

```
<details><summary>docker-compose.yml</summary>

```yaml
version: "3.6"

services:
Expand All @@ -148,17 +151,19 @@ services:
ports:
- 8000
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
$ SPLUNK_PASSWORD=<password> docker-compose up -d
```

## Create standalone with SplunkBase app
<details><summary>docker-compose.yml</summary><p>
Apps showcased on SplunkBase can also be installed using this Docker image.

```
<details><summary>docker-compose.yml</summary>

```yaml
version: "3.6"

services:
Expand All @@ -174,17 +179,19 @@ services:
ports:
- 8000
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
$ SPLUNKBASE_PASSWORD=<splunkbase_password> SPLUNK_PASSWORD=<password> docker-compose up -d
```

## Create standalone and universal forwarder
<details><summary>docker-compose.yml</summary><p>
You can also enable distributed deployments. In this case, we can create a Splunk universal forwarder running in a container to stream logs to a Splunk standalone, also running in a container.

```
<details><summary>docker-compose.yml</summary>

```yaml
version: "3.6"

networks:
Expand Down Expand Up @@ -225,7 +232,7 @@ services:
- 8000
- 8089
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
Expand All @@ -235,9 +242,9 @@ $ SPLUNK_PASSWORD=<password> docker-compose up -d
## Create heavy forwarder
The following will allow you spin up a forwarder, and stream its logs to an independent, external indexer located at `idx1-splunk.company.internal`, as long as that hostname is reachable on your network.

<details><summary>docker-compose.yml</summary><p>
<details><summary>docker-compose.yml</summary>

```
```yaml
version: "3.6"

networks:
Expand All @@ -263,7 +270,7 @@ services:
ports:
- 1514
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
Expand All @@ -273,9 +280,9 @@ $ SPLUNK_PASSWORD=<password> docker-compose up -d
## Create heavy forwarder and deployment server
The following will allow you spin up a forwarder, and stream its logs to an independent, external indexer located at `idx1-splunk.company.internal`, as long as that hostname is reachable on your network. Additionally, it brings up a deployment server, which will download an app and distribute it to the heavy forwarder.

<details><summary>docker-compose.yml</summary><p>
<details><summary>docker-compose.yml</summary>

```
```yaml
version: "3.6"

networks:
Expand Down Expand Up @@ -316,7 +323,7 @@ services:
- SPLUNK_APPS_URL=https://artifact.company.internal/splunk_app.tgz
- SPLUNK_PASSWORD
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
Expand All @@ -330,9 +337,9 @@ $ docker run -it -e SPLUNK_PASSWORD=<password> splunk/splunk:latest create-defau
```

Additionally, review the `docker-compose.yml` below to understand how linking Splunk instances together through roles and environment variables is accomplished:
<details><summary>docker-compose.yml</summary><p>
<details><summary>docker-compose.yml</summary>

```
```yaml
version: "3.6"

networks:
Expand Down Expand Up @@ -445,7 +452,7 @@ services:
volumes:
- ./default.yml:/tmp/defaults/default.yml
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
Expand All @@ -459,9 +466,9 @@ $ docker run -it -e SPLUNK_PASSWORD=<password> splunk/splunk:latest create-defau
```

Additionally, review the `docker-compose.yml` below to understand how linking Splunk instances together through roles and environment variables is accomplished:
<details><summary>docker-compose.yml</summary><p>
<details><summary>docker-compose.yml</summary>

```
```yaml
version: "3.6"

networks:
Expand Down Expand Up @@ -575,7 +582,7 @@ services:
volumes:
- ./default.yml:/tmp/defaults/default.yml
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
Expand All @@ -589,9 +596,9 @@ $ docker run -it -e SPLUNK_PASSWORD=<password> splunk/splunk:latest create-defau
```

Additionally, review the `docker-compose.yml` below to understand how linking Splunk instances together through roles and environment variables is accomplished:
<details><summary>docker-compose.yml</summary><p>
<details><summary>docker-compose.yml</summary>

```
```yaml
version: "3.6"

networks:
Expand Down Expand Up @@ -776,17 +783,17 @@ services:
volumes:
- ./default.yml:/tmp/defaults/default.yml
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
$ docker-compose up -d
```

## Enable root endpoint on SplunkWeb
<details><summary>docker-compose.yml</summary><p>
<details><summary>docker-compose.yml</summary>

```
```yaml
version: "3.6"

services:
Expand All @@ -800,7 +807,7 @@ services:
ports:
- 8000
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
Expand All @@ -810,9 +817,9 @@ $ SPLUNK_PASSWORD=<password> docker-compose up -d
Then, visit SplunkWeb on your browser with the root endpoint in the URL, such as `http://localhost:8000/splunkweb`.

## Create sidecar forwarder
<details><summary>k8s-sidecar.yml</summary><p>
<details><summary>k8s-sidecar.yml</summary>

```
```yaml
apiVersion: v1
kind: Pod
metadata:
Expand Down Expand Up @@ -842,7 +849,7 @@ spec:
- name: shared-data
emptyDir: {}
```
</p></details>
</details>

Execute the following to bring up your deployment:
```
Expand Down
Loading