Balena Pi-Hole query logs to Splunk

Product support
1

Hi All,

I am suing balena Pi-hole for my home office scenario, almost 30 devices using Pi-Hole as DNS which is configured automatically on them (no hard coding of DNS on individual device). I am very impressed with the clarity of the query log.
My question is - can we send the query logs to outside any tools like splunk in real-time ?

Thanks,
Amit

3

Hey @amit3bcrec, you’re looking for something like this?

It looks like we would need to add several things to the project, including but not limited to:

  1. the splunk binary for ARM, or whichever platform we are targeting
  2. inputs and outputs config files for splunk
  3. install any splunk dependencies
  4. set the splunkforwarder to start on container start, after Pi-hole

A better plan might be to run the splunk forwarder as it’s own container, to avoid conflicting with the Pi-hole installation and dependencies. We could put the logs on a shared volume or something like that.
https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/DeployandrunauniversalforwarderinsideaDockercontainer

This is not a service I’ve used myself, so I’m not sure I’m the best candidate to ensure it’s working correctly. I’ve opened an issue on the balena-pihole repo in case anyone in the community is will to lend a hand and get us started.