DEV Community

Raghavvram Johnson
Raghavvram Johnson

Posted on

šŸš€ Splunk Core deployment Guide: Docker Server & Arch Linux Forwarder

#splunk #docker #arch #linux

This reference manual documents the complete architecture, configurations, and commands required to spin up a standalone Splunk indexer and securely ingest host operating system events.

Part 1: Splunk Enterprise Server (Docker Compose)

We deployed a permanent Splunk Free environment on the x86_64 architecture. Using Docker volumes ensures all indexed data, search structures, and dashboards persist through restarts.

  1. Deployment File Configuration

Create a dedicated working directory and save this file exactly as docker-compose.yml:

services:
  splunk:
    image: splunk/splunk:latest
    container_name: splunk_free
    environment:
      # Accept the mandatory Splunk licensing terms
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com

      # Activates the perpetual 500MB/day Free license immediately
      - SPLUNK_LICENSE_URI=Free

      # Required for internal initialization protocols
      - SPLUNK_PASSWORD=YourSecurePassword123!
    ports:
      - "8000:8000"   # Splunk Web UI Browser Console
      - "8088:8088"   # HTTP Event Collector (HEC) API Ingestion
      - "9997:9997"   # Splunk Indexer - Receiving port for Forwarders
    volumes:
      - splunk_etc:/opt/splunk/etc  # Stores configuration settings and custom apps
      - splunk_var:/opt/splunk/var  # Stores raw indexed log databases
    restart: unless-stopped

volumes:
  splunk_etc:
  splunk_var:
Enter fullscreen mode Exit fullscreen mode
  1. Operational Operations
  • Start Stack: docker compose up -d
  • Stop Stack: docker compose down
  • Web UI URL: Access http://localhost:8000 (Free Mode automatically routes directly into the unauthenticated workspace).
  1. Server Configuration Constraint (Crucial Step)

Before any external machine can communicate with this container, the indexer engine must be instructed to listen on its data pipeline port:

  1. Navigate to Settings > Forwarding and receiving.
  2. Click Configure receiving under the Receive data column header.
  3. Select New Receiving Port, enter 9997, and click Save.

Part 2: Host Node Log Ingestion (Arch Linux)

Because Arch Linux relies natively on systemd-journald instead of traditional structural text files (like syslog), we implemented a direct, low-overhead native script architecture.

  1. Install the Agent Binary via AUR

Install the stable binary tracking from the Arch User Repository:

paru -S splunkforwarder
Enter fullscreen mode Exit fullscreen mode
  1. Initial Setup Credentials

Initialize the runtime parameters to establish the root control passwords:

sudo /opt/splunkforwarder/bin/splunk start --accept-license
Enter fullscreen mode Exit fullscreen mode

(Provide username admin and create a distinct local agent password when prompted, then stop the session via sudo /opt/splunkforwarder/bin/splunk stop to return control to systemd).

  1. Establish System Target Routing

Map the outbound forwarding path toward the container server. If the agent runs on the same underlying operating system as Docker, target the internal loopback:

sudo /opt/splunkforwarder/bin/splunk add forward-server 127.0.0.1:9997 -auth admin:<YourForwarderPassword>
Enter fullscreen mode Exit fullscreen mode
  1. Overcome Arch Systemd Journal Security Boundaries

The splunk daemon user created by the package must be explicitly allowed to look inside binary operating system logging streams:

sudo usermod -aG systemd-journal splunk
Enter fullscreen mode Exit fullscreen mode
  1. Configure Native Journal Ingestion File

Rather than fighting text-file translation limits, manually specify a high-performance native journald input receiver stream.

Open the system configuration manager:

sudo nvim /opt/splunkforwarder/etc/system/local/inputs.conf
Enter fullscreen mode Exit fullscreen mode

Overwrite or append the exact parameters below:

[default]
host = arch-workstation

[journald://system_logs]
disabled = false
index = main
sourcetype = journald
Enter fullscreen mode Exit fullscreen mode
  1. Permission Realignment & Service Activation

Force a complete runtime ownership sync on application directories and hand engine lifecycle tracking to the native scheduler:

sudo chown -R splunk:splunk /opt/splunkforwarder
sudo chmod -R 755 /opt/splunkforwarder
sudo systemctl enable --now splunkforwarder.service
Enter fullscreen mode Exit fullscreen mode

Part 3: Telemetry Analysis

To confirm telemetry streams are transmitting across isolation boundaries, load the Splunk Search Panel and run the following queries:

  • Verify Infrastructure Logs Inbound:

    index="main" sourcetype="journald"

  • Verify Client-to-Server Health Interconnectivity:

    index="_internal" sourcetype="splunkd"

And Congratulations, you have successfully installed Splunk Free Edition

Top comments (0)