Monitoring Docker
Forward Docker container logs, metrics, and events to Splunk.
Run a single Collectord container per host - Docker, Swarm, Podman or Amazon ECS - and forward logs, metrics, and events from every container on the box into a Splunk events or metrics index, with dashboards that lead you to what needs fixing and an Alert Catalog to pick your alerts from.
Installation
Set up the Splunk app and HEC, and run the Collectord container
→Concepts
What Collectord does, the data model, and how configuration layers
→Configuration
Config file layout and override settings
→Dashboards
What each page of the app is for, menu by menu
→Container annotations
Use container labels to control log forwarding behavior
→Container labels reference
Full list of every container label grouped by datatype
→Splunk indexes
Configure which Splunk indexes receive data
→Metrics index
Send host, container and process stats to a Splunk metrics index
→Splunk field extraction
Define search-time field extraction rules for container logs
→Splunk HTTP Event Collector
Configure SSL and connection settings for Splunk HEC
→Prometheus metrics
Scrape Prometheus metrics from containers
→Common Information Model
Map hosts, container restarts and CPU vulnerabilities to CIM data models
→Multiple clusters
Identify and differentiate multiple clusters in Splunk
→Object polling
Poll Docker API for containers, images, volumes and Swarm objects
→License server
Distribute license keys across hosts from a central URL
→Alert Catalog
Pick, scope and create alerts from templates
→Troubleshooting
Run verify command and diagnose common issues
→Release history
Changelog of Collectord and Splunk app releases
→Upgrade
Step-by-step version upgrade instructions
→Security
Image security, container privileges, and Docker API access
→