Question 155 - DCA discussion

The commanddocker run --log-driver=splunkfor every container at run time will configure a Docker container to export container logs to the logging solution.The reason is that the--log-driveroption specifies the logging driver for the container, which determines how the container logs are handled1.Thesplunklogging driver is a plugin that sends container logs to HTTP Event Collector in Splunk Enterprise and Splunk Cloud2.To use thesplunklogging driver, you also need to provide some additional options with the--log-optflag, such as the Splunk token, URL, source, sourcetype, index, etc2. For example, to run a container with thesplunklogging driver and send the logs to a Splunk instance with the URLhttps://splunk.example.com:8088and the token176fabb6-7811-4b3a-8ba0-4d49302e50f2, you can use:

docker run --log-driver=splunk --log-opt splunk-token=176fabb6-7811-4b3a-8ba0-4d49302e50f2 --log-opt splunk-url=https://splunk.example.com:8088 ...

This way, you can configure a Docker container to export container logs to Splunk, which is a centralized logging solution.Alternatively, you can also configure thesplunklogging driver as the default logging driver for the Docker daemon by setting thelog-driverandlog-optskeys in thedaemon.jsonfile and restarting Docker3. This will apply thesplunklogging driver to all containers unless overridden by the--log-driveroption.Reference:

Configure logging drivers

Splunk logging driver

Set the logging driver for the Docker daemon