Getting Data In

Retrieving Docker container logs using Splunk

nanduni
Explorer

Hi all,

I am a newbie to Splunk and since few days, I am attempting to use Splunk to retrieve docker container logs. I tried using docker image of Splunk Enterprise. With that, I could access the Splunk instance on the browser through http://localhost:8000. Thereafter, I am stuck. I used the following command and that gave me the following error message.

docker run --log-driver=splunk --log-opt splunk-url=http://localhost:8000 --log-opt splunk-token=B0AE18EB-4A5F-4A78-911D-033265BA430A nginx
docker: Error response from daemon: Failed to initialize logging driver: splunk: failed to verify connection - 303 See Other - http-equiv="content-type" content="text/html; charset=UTF-8">

0 Karma
1 Solution

nanduni
Explorer

I managed to resolve this by running Splunk Enterprise Docker Image as follows.

docker run -d -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_USER=root" -p "8000:8000" -p "8088:8088" splunk/splunk

@dcharboneau, Thank you very much for pointing out my errors.

View solution in original post

0 Karma

nanduni
Explorer

I managed to resolve this by running Splunk Enterprise Docker Image as follows.

docker run -d -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_USER=root" -p "8000:8000" -p "8088:8088" splunk/splunk

@dcharboneau, Thank you very much for pointing out my errors.

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

I believe this could be the TCP port you are using is 8000 which is the web interface. Try 8088. Also looks like you need to be using HTTPS not HTTP.

https://docs.docker.com/engine/admin/logging/splunk/#splunk-options

nanduni
Explorer

Thank you for the response.

I tried that as well, still gives me errors.

$ docker run --log-driver=splunk --log-opt splunk-url=https://127.0.0.1:8088 --log-opt splunk-token=FD7C8352-E4FE-40AB-B2EA-01A1DEC6F7D9 nginx
docker: Error response from daemon: Failed to initialize logging driver: dial tcp 127.0.0.1:8088: getsockopt: connection refused.
ERRO[0001] error getting events from daemon: net/http: request canceled

Any suggestions to resolve this ?

Thanks.

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

Did you try http as well. Ran though HEC setup on splunk and if you didn't select ssl it may just be clear text.

0 Karma

nanduni
Explorer

Yes, I tried that as well. In Global settings, I enabled/disabled SSL and checked with https/http as well. But that still continues to give me the same error log.

In Docker documentation that you have pointed out, it is mentioned to specify the splunk-url in the format https://your_splunk_instance:8088. Here, what does this 'your_splunk_instance' refers to? I assumed that to be 127.0.0.1, from which I accessed the web interface. Am I correct?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...