Splunk universal forwarder on Raspberry Pi 4

General
1

Folks:

Just a quick post to note that I had a wild idea about getting a Splunk universal forwarder running in a Balena Raspberry Pi 4 application, so I could send app log files to my splunk cloud instance. I’ve always kind of hated the Docker/Splunk HEC integration- classifying files and handling multiline events is a huge mess under HEC- so I thought it’d be decent to be able to use a universal forwarder.

Googling suggested that nobody has published prior art on this, so I wrote it.

You can find a sample Balena app, using Apache2 as the app log generator, at https://github.com/pdehlke/balena-splunk.

I hope this is useful for anyone other than just me!

Comments and PRs are more than welcome :slight_smile:

-Pete

4

Hi Pete,
Thank you for writing and sharing your idea. That will be really useful for other users! :slight_smile:
Look forward to seeing what you do next.