Splunk Local Testing Environment

A Docker Compose setup for running a local Splunk instance with log generators for comprehensive testing and development.

Quick Start

1. Start Splunk:

   docker-compose up -d
   

2. Access Splunk Web UI:

   • URL: http://localhost:8000
   • Username: admin
   • Password: admin123

3. Stop Splunk:

   docker-compose down
   

Services

Splunk Enterprise

• Web UI: http://localhost:8000
• HEC Endpoint: http://localhost:8088
• Management Port: 8089
• Splunk2Splunk: 9997
• Syslog: 514/udp

Universal Forwarder (Optional)

To enable the Universal Forwarder for testing log forwarding:

docker-compose --profile forwarder up -d

Log Generators (Optional)

To enable log generators for testing data ingestion:

docker-compose --profile generators up -d

Combined Setup

To run everything together (Splunk + forwarder + generators):

docker-compose --profile forwarder --profile generators up -d

Configuration

• Default credentials: admin/admin123
• HEC Token: 00000000-0000-0000-0000-000000000000
• Configuration files: ./config/
• Log directory: ./logs/

Data Persistence

Splunk data is persisted in Docker volumes:

• splunk_etc: Splunk configuration
• splunk_var: Splunk data and logs

To reset all data:

docker-compose down -v

Log Generators

The environment includes multiple log generators to create realistic test data:

Available Generators

• Web Access Logs (log_generator_web): Apache-style access logs with realistic traffic patterns
• Syslog Messages (log_generator_syslog): RFC3164 compliant system logs from various services
• JSON Application Logs (log_generator_json): Structured application logs with user events, API calls, and metrics
• HTTP Event Collector (log_generator_hec): Direct event submission to Splunk HEC endpoint

Log Output Locations

• Web logs: ./logs/web_access.log
• Syslog: ./logs/syslog.log
• JSON logs: ./logs/application.json
• HEC events: Sent directly to Splunk HEC

Adding New Generators

1. Create your generator script in the ./generators/ directory
2. Add a new service to docker-compose.yml under the generators profile
3. Mount ./generators:/app and optionally ./logs:/var/log/app volumes
4. Update this README with your new generator's details

The Universal Forwarder will automatically pick up and forward any new log files placed in the ./logs/ directory.