bpmcdevitt/splunk_local
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
a localized splunk instance for development/testing purposes in a docker container
1 commit 1 branch 0 tags 64 KiB
Python 100%
Find a file
bpmcdevitt f77427fea8 Initial commit: Add Docker Compose Splunk testing environment 
Set up complete local Splunk instance with:
- Splunk Enterprise container with web UI and HEC
- Optional Universal Forwarder for log forwarding
- Persistent volumes for data and configuration
- Development documentation and configuration files

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-19 16:52:36 -05:00
config Initial commit: Add Docker Compose Splunk testing environment 2025-07-19 16:52:36 -05:00
.env Initial commit: Add Docker Compose Splunk testing environment 2025-07-19 16:52:36 -05:00
.gitignore Initial commit: Add Docker Compose Splunk testing environment 2025-07-19 16:52:36 -05:00
CLAUDE.md Initial commit: Add Docker Compose Splunk testing environment 2025-07-19 16:52:36 -05:00
docker-compose.yml Initial commit: Add Docker Compose Splunk testing environment 2025-07-19 16:52:36 -05:00
README.md Initial commit: Add Docker Compose Splunk testing environment 2025-07-19 16:52:36 -05:00

README.md

Splunk Local Testing Environment

A Docker Compose setup for running a local Splunk instance for testing and development purposes.

Quick Start

  1. Start Splunk:

    docker-compose up -d

  2. Access Splunk Web UI:

  3. Stop Splunk:

    docker-compose down

Services

Splunk Enterprise

Universal Forwarder (Optional)

To enable the Universal Forwarder for testing log forwarding:

docker-compose --profile forwarder up -d

Configuration

  • Default credentials: admin/admin123
  • HEC Token: 00000000-0000-0000-0000-000000000000
  • Configuration files: ./config/
  • Log directory: ./logs/

Data Persistence

Splunk data is persisted in Docker volumes:

  • splunk_etc: Splunk configuration
  • splunk_var: Splunk data and logs

To reset all data:

docker-compose down -v