🚀 Splunk Core deployment Guide: Docker Server & Arch Linux Forwarder

This article provides a detailed guide on setting up a standalone Splunk Enterprise environment using Docker Compose and Arch Linux Forwarder. The first part of the guide covers deploying the Splunk indexer and configuring the necessary environment settings.

In Part 1, a dedicated working directory is created and a docker-compose.yml file is saved with specific configurations for the Splunk service. Essential environment variables are set, including license acceptance terms, password, and ports for Splunk Web UI, HTTP Event Collector, and the receiving port for Forwarders. Volumes are mapped to store configuration settings, indexed data, and raw log databases. The Splunk service is then started using docker compose.

Part 2 focuses on ingesting host node logs from an Arch Linux system. Since Arch Linux natively uses systemd-journald, a direct and efficient script architecture is implemented to log data from structural text files. The agent binary is installed from the Arch User Repository, initial setup credentials are provided, and a forwarding server mapping is established.

Permissions are adjusted to allow the splunk daemon user to access binary operating system logging streams. A custom input receiver stream is configured to handle journald logs effectively. Finally, the Splunk forwarder service is enabled and started.

In Part 3, a method is outlined to verify that telemetry streams are successfully transmitting across isolation boundaries. Queries are executed in the Splunk Search Panel to check for inbound infrastructure logs and client-to-server health interconnectivity. The completion of this guide results in the successful installation of the Splunk Free Edition on the Arch Linux system.