Outcold Solutions is sponsoring Splunk .conf26 - see you there!

Monitoring Docker

Forward Docker container logs, metrics, and events to Splunk.

Run a single Collectord container per host and forward logs, metrics, and Docker events from every container on the box - automatically.

Set up Splunk app, HEC, and run collectord container
→ Installation

What Collectord does, the data model, and how configuration layers
→ Concepts

Config file layout and override settings
→ Configuration

Use container labels to control log forwarding behavior
→ Container annotations

Full list of every container label grouped by datatype
→ Container labels reference

Configure which Splunk indexes receive data
→ Splunk indexes

Define search-time field extraction rules for container logs
→ Splunk field extraction

Configure SSL and connection settings for Splunk HEC
→ Splunk HTTP Event Collector

Scrape Prometheus metrics from containers
→ Prometheus metrics

Identify and differentiate multiple clusters in Splunk
→ Multiple clusters

Poll Docker API for container and image data
→ Object polling

Distribute license keys across hosts from a central URL
→ License server

Predefined alerts for license, health, and container restarts
→ Alerts

Run verify command and diagnose common issues
→ Troubleshooting

Changelog of all collectord and Splunk app releases
→ Release history

Step-by-step version upgrade instructions
→ Upgrade

Image security, container privileges, and Docker API access
→ Security