This reference manual documents the complete architecture, configurations, and commands required to spin up a standalone Splunk indexer and securely ingest host operating system events.

Part 1: Splunk Enterprise Server (Docker Compose)

We deployed a permanent Splunk Free environment on the x86_64 architecture. Using Docker volumes ensures all indexed data, search structures, and dashboards persist through restarts.

  1. Deployment File Configuration

Create a dedicated working directory and save this file exactly as docker-compose.yml:

services: splunk: image: splunk/splunk:latest container_name: splunk_free environment: # Accept the mandatory Splunk licensing terms - SPLUNK_START_ARGS=--accept-license - SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com # Activates the perpetual 500MB/day Free license immediately - SPLUNK_LICENSE_URI=Free # Required for internal initialization protocols - SPLUNK_PASSWORD=YourSecurePassword123! ports: - "8000:8000" # Splunk Web UI Browser Console - "8088:8088" # HTTP Event Collector (HEC) API Ingestion - "9997:9997" # Splunk Indexer - Receiving port for Forwarders volumes: - splunk_etc:/opt/splunk/etc # Stores configuration settings and custom apps - splunk_var:/opt/splunk/var # Stores raw indexed log databases restart: unless-stopped volumes: splunk_etc: splunk_var:
  1. Operational Operations
  • Start Stack: docker compose up -d
  • Stop Stack: docker compose down
  • Web UI URL: Access http://localhost:8000 (Free Mode automatically routes directly into the unauthenticated workspace).
  1. Server Configuration Constraint (Crucial Step)

Before any external machine can communicate with this container, the indexer engine must be instructed to listen on its data pipeline port:

  1. Navigate to Settings > Forwarding and receiving.
  2. Click Configure receiving under the Receive data column header.
  3. Select New Receiving Port, enter 9997, and click Save.

Part 2: Host Node Log Ingestion (Arch Linux)

Because Arch Linux relies natively on systemd-journald instead of traditional structural text files (like syslog), we implemented a direct, low-overhead native script architecture.

  1. Install the Agent Binary via AUR

Install the stable binary tracking from the Arch User Repository:

paru -S splunkforwarder
  1. Initial Setup Credentials

Initialize the runtime parameters to establish the root control passwords:

sudo /opt/splunkforwarder/bin/splunk start --accept-license

(Provide username admin and create a distinct local agent password when prompted, then stop the session via sudo /opt/splunkforwarder/bin/splunk stop to return control to systemd).

  1. Establish System Target Routing

Map the outbound forwarding path toward the container server. If the agent runs on the same underlying operating system as Docker, target the internal loopback:

sudo /opt/splunkforwarder/bin/splunk add forward-server 127.0.0.1:9997 -auth admin:<YourForwarderPassword>
  1. Overcome Arch Systemd Journal Security Boundaries

The splunk daemon user created by the package must be explicitly allowed to look inside binary operating system logging streams:

sudo usermod -aG systemd-journal splunk
  1. Configure Native Journal Ingestion File

Rather than fighting text-file translation limits, manually specify a high-performance native journald input receiver stream.

Open the system configuration manager:

sudo nvim /opt/splunkforwarder/etc/system/local/inputs.conf

Overwrite or append the exact parameters below:

[default] host = arch-workstation [journald://system_logs] disabled = false index = main sourcetype = journald
  1. Permission Realignment & Service Activation

Force a complete runtime ownership sync on application directories and hand engine lifecycle tracking to the native scheduler:

sudo chown -R splunk:splunk /opt/splunkforwarder sudo chmod -R 755 /opt/splunkforwarder sudo systemctl enable --now splunkforwarder.service

Part 3: Telemetry Analysis

To confirm telemetry streams are transmitting across isolation boundaries, load the Splunk Search Panel and run the following queries:

  • Verify Infrastructure Logs Inbound:

    index="main" sourcetype="journald"

  • Verify Client-to-Server Health Interconnectivity:

    index="_internal" sourcetype="splunkd"

And Congratulations, you have successfully installed Splunk Free Edition