pwmcintyre / splunk_docker_cluster

Splurnk

Dear future me, please run this:

docker run -p 8000:8000 -v pwd/my_app:/opt/splunk/etc/apps/my_app --env SPLUNK_START_ARGS="--accept-license" splunk/splunk

docker rm docker ps --no-trunc -aq

docker-compose rm -f && docker-compose up splunk_master splunk_indexer_1

docker stop splunk_fwd

To rebuild the images

docker-compose build

docker (the hypervisor thing which does stuff) images (these are templates for pre-made stuff) containers (which are an instance of an image)

docker 1--* images 1--* containers

Git stuff

Clean (be careful, you will lose any unsaved work)

git clean -fdx && git reset --hard

splunk_docker_cluster's Issues

I've lost my dashboard, help

When I go to one search head and save a dashboard, then come back and go to another search head, my dashboard is gone! 😨

Feature: Load Balancer please

There's no load balancer, just a bunch of search heads 😞

AS A user of the application
I WANT a single URL to go to
SO I don't have to know which head to go to

GIVEN I have docker + docker-compose
WHEN I run docker-compose up
THEN I want a single URL to hit to access this cluster UI

internal logs not coming in

looks like the internal logs aren't showing up, is suspect they're not being forwarded to the indexers

ie. search index=_internal and you will only see data from the indexer, not the heads or master