#SPLUNK ENTERPRISE SUPPORT HOW TO#
#SPLUNK ENTERPRISE SUPPORT DRIVER#
#SPLUNK ENTERPRISE SUPPORT MANUAL#

#SPLUNK ENTERPRISE SUPPORT MANUAL#

The Distributed Deployment Manual has lots of information on spreading Splunk services across a number of computers. While this topic is geared more toward deploying Splunk in a Windows environment, Splunk itself also has distributed deployment capabilities that you should be aware of, even as you integrate it into your Windows enterprise.

#SPLUNK ENTERPRISE SUPPORT HOW TO#

This topic discusses some of those scenarios and offers guidelines on how to best adapt your Splunk for Windows deployment to your enterprise. In the event you fall into an unsupported state, you may find support on Splunk Answers or through the open-source communities found on GitHub for this docker-splunk project or the related splunk-ansible project.You can integrate Splunk into your Windows environment in any number of ways.

You are using features not officially supported by Splunk.

You are running Splunk Enterprise and/or Splunk Universal Forwarder in a container on a platform not officially supported by Splunk.

You do not have an active support contract.

In the following conditions, Splunk Support reserves the right to deem your installation unsupported and not provide assistance when issues arise:

Open a support case on the support portal.

If you are a Splunk Enterprise customer with a valid support entitlement contract and have a Splunk-related question, you can

Join us on Slack and post in the #docker channel.

For all other configurations, contact Splunk Professional Services.

Splunk Support only provides support for the single instance Splunk Validated Architectures (S-Type), Universal Forwarders and Heavy Forwarders.

Basic instructions to deploy and run Splunk Enterprise inside containers.

Supported platforms for containerized Splunk software environments.

Docker does not start if the daemon.json file contains badly-formed JSON. Note: If you already have an existing JSON file, add only 'storage-driver': 'overlay2' as a key-value pair.

Assuming the file was empty, add the following contents:.

#SPLUNK ENTERPRISE SUPPORT DRIVER#

OverlayFS overlay2 Docker daemon storage driver.ItвЂ™s possible that this Docker image still works, although you may need to manually add the environment variable KUBERNETES_SERVICE_HOST=kubernetes to configure the provisioning hooks properly. Note: If you are using podman, CRI-O, containerd or other container runtimes, please be aware that these are currently outside of our support/testing matrix. Docker Enterprise Engine 17.06.2 or higherДocker Community Engine 17.06.2 or higher.splunk/universalforwarder image supports both x86-64 and s390x chipsets.splunk/splunk image supports x86-64 chipsets.Linux-based operating system, such as Debian, CentOS, and so on.

The following prerequisites and dependencies must be installed on each node you plan on deploying the container. Failure to do so will render your deployment in an unsupported state. If you intend for this containerized Splunk Enterprise deployment to be supported in your Enterprise Support Agreement, you must verify you meet all of the requirements below. Throughout this document, the term вЂњsupportedвЂќ means you can contact Splunk Support for assistance with issues. However, because not all settings apply to all customers, Splunk will only support the most common subset of all configurations. Splunk Enterprise contains many settings that allow customers to tailor their Splunk environment.

Splunk enterprise support