splunk-stack.yml

version: '3.3'

networks:
  splunk-backend:
    driver: overlay

volumes:
  splunk-forwarder-etc:
    driver: cloudstor
  splunk-forwarder-var: 
    driver: cloudstor
           
services:

  splunk-forwarder:
    image: splunk/universalforwarder:7.0.0-monitor
    environment:
      SPLUNK_START_ARGS: '--accept-license --answer-yes'
      SPLUNK_USER: "root"
      SPLUNK_PASSWORD: "Password123"
      SPLUNK_FORWARD_SERVER: 'splunk-enterprise-server:9997'
    hostname: splunk-forwarder-server
    deploy:
      mode: replicated
      replicas: 1
    networks:
      splunk-backend:
    volumes:
      - splunk-forwarder-etc:/opt/splunk/etc
      - splunk-forwarder-var:/opt/splunk/var
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/containers:/host/containers:ro