Initial commit: Add Docker Compose Splunk testing environment

Set up complete local Splunk instance with:
- Splunk Enterprise container with web UI and HEC
- Optional Universal Forwarder for log forwarding
- Persistent volumes for data and configuration
- Development documentation and configuration files

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.env

@@ -0,0 +1,6 @@
+# Splunk Configuration
+SPLUNK_PASSWORD=admin123
+SPLUNK_HEC_TOKEN=00000000-0000-0000-0000-000000000000
+
+# Container Configuration
+COMPOSE_PROJECT_NAME=splunk_local

.gitignore

@@ -0,0 +1,32 @@
+# Docker
+.env.local
+docker-compose.override.yml
+
+# Logs
+*.log
+logs/*.log
+
+# Splunk generated files
+*.idx
+*.dat
+*.tmp
+
+# OS generated files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# IDE files
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# Temporary files
+*.tmp
+*.bak
+*.backup

CLAUDE.md

@@ -0,0 +1,58 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+This is a Docker Compose-based local Splunk testing environment. The setup includes:
+- Splunk Enterprise instance for testing and development
+- Optional Universal Forwarder for log forwarding scenarios
+- Persistent data volumes for configuration and data retention
+
+## Common Commands
+
+### Docker Operations
+- Start Splunk: `docker-compose up -d`
+- Start with forwarder: `docker-compose --profile forwarder up -d`
+- Stop services: `docker-compose down`
+- Reset all data: `docker-compose down -v`
+- View logs: `docker-compose logs splunk`
+- Access Splunk shell: `docker-compose exec splunk bash`
+
+### Splunk Access
+- Web UI: http://localhost:8000 (admin/admin123)
+- HEC endpoint: http://localhost:8088
+- Management API: http://localhost:8089
+
+## Architecture
+
+### Service Structure
+- **splunk**: Main Splunk Enterprise container
+- **splunk_forwarder**: Optional Universal Forwarder (profile: forwarder)
+
+### Key Directories
+- `config/`: Splunk configuration files mounted to container
+- `logs/`: Directory for sample logs to be forwarded
+- Docker volumes: `splunk_etc`, `splunk_var` for data persistence
+
+### Ports
+- 8000: Splunk Web UI
+- 8088: HTTP Event Collector (HEC)
+- 8089: Splunk Management Port
+- 9997: Splunk2Splunk forwarding
+- 514/udp: Syslog input
+
+## Configuration Files
+
+- `docker-compose.yml`: Main service definitions
+- `.env`: Environment variables (passwords, tokens)
+- `config/default.yml`: Splunk default configuration
+- Volume mounts allow for persistent configuration across container restarts
+
+## Testing Workflows
+
+The environment is designed for:
+- Testing Splunk apps and configurations
+- Log ingestion and forwarding scenarios
+- Search and dashboard development
+- API integration testing with HEC

README.md

@@ -0,0 +1,53 @@
+# Splunk Local Testing Environment
+
+A Docker Compose setup for running a local Splunk instance for testing and development purposes.
+
+## Quick Start
+
+1. Start Splunk:
+   ```bash
+   docker-compose up -d
+   ```
+
+2. Access Splunk Web UI:
+   - URL: http://localhost:8000
+   - Username: admin
+   - Password: admin123
+
+3. Stop Splunk:
+   ```bash
+   docker-compose down
+   ```
+
+## Services
+
+### Splunk Enterprise
+- **Web UI**: http://localhost:8000
+- **HEC Endpoint**: http://localhost:8088
+- **Management Port**: 8089
+- **Splunk2Splunk**: 9997
+- **Syslog**: 514/udp
+
+### Universal Forwarder (Optional)
+To enable the Universal Forwarder for testing log forwarding:
+```bash
+docker-compose --profile forwarder up -d
+```
+
+## Configuration
+
+- Default credentials: admin/admin123
+- HEC Token: 00000000-0000-0000-0000-000000000000
+- Configuration files: `./config/`
+- Log directory: `./logs/`
+
+## Data Persistence
+
+Splunk data is persisted in Docker volumes:
+- `splunk_etc`: Splunk configuration
+- `splunk_var`: Splunk data and logs
+
+To reset all data:
+```bash
+docker-compose down -v
+```

config/default.yml

@@ -0,0 +1,31 @@
+# Splunk default configuration
+# This file will be copied to /tmp/defaults in the container
+
+splunk:
+  conf:
+    user-seed:
+      content:
+        user_info:
+          USERNAME: admin
+          PASSWORD: admin123
+    
+    # Enable HEC by default
+    inputs:
+      content:
+        http:
+          disabled: 0
+          port: 8088
+          enableSSL: 0
+          
+    # Basic server configuration
+    server:
+      content:
+        general:
+          serverName: splunk_local
+          
+    # Web configuration
+    web:
+      content:
+        settings:
+          enableSplunkWebSSL: false
+          httpport: 8000

docker-compose.yml

@@ -0,0 +1,45 @@
+version: '3.8'
+
+services:
+  splunk:
+    image: splunk/splunk:latest
+    container_name: splunk_local
+    environment:
+      - SPLUNK_START_ARGS=--accept-license
+      - SPLUNK_PASSWORD=admin123
+      - SPLUNK_HEC_TOKEN=00000000-0000-0000-0000-000000000000
+    ports:
+      - "8000:8000"   # Splunk Web UI
+      - "8088:8088"   # HTTP Event Collector (HEC)
+      - "9997:9997"   # Splunk2Splunk
+      - "8089:8089"   # Splunk Management Port
+      - "514:514/udp" # Syslog
+    volumes:
+      - splunk_etc:/opt/splunk/etc
+      - splunk_var:/opt/splunk/var
+      - ./config:/tmp/defaults
+    restart: unless-stopped
+
+  # Optional: Universal Forwarder for testing log forwarding
+  splunk_forwarder:
+    image: splunk/universalforwarder:latest
+    container_name: splunk_forwarder
+    environment:
+      - SPLUNK_START_ARGS=--accept-license
+      - SPLUNK_PASSWORD=admin123
+      - SPLUNK_FORWARD_SERVER=splunk:9997
+    volumes:
+      - ./logs:/var/log/app
+      - splunk_uf_etc:/opt/splunkforwarder/etc
+      - splunk_uf_var:/opt/splunkforwarder/var
+    depends_on:
+      - splunk
+    restart: unless-stopped
+    profiles:
+      - forwarder
+
+volumes:
+  splunk_etc:
+  splunk_var:
+  splunk_uf_etc:
+  splunk_uf_var: