Splunk Enterprise (free trial) Server Deployment Overview¶

Prerequisites¶

The following conditions are required for the application to function correctly:

Docker and Docker Compose must be installed.
Internet access is required to obtain Let's Encrypt SSL certificates.
Ports 80, 443, and 8000 must be open in the firewall.

FQDN of the final panel on hostkey.in domain¶

Parameter	Value
Prefix	`splunk`
Domain	`hostkey.in`
Full template	`splunk{Server_ID_from_Invapi}.hostkey.in`

File and Directory Structure¶

Main directories and files in the system:

/root/splunk — application working directory containing the Docker Compose configuration.
/data/nginx/user_conf.d/ — directory for Nginx user configurations.
nginx_secrets (external volume) — storage for Let's Encrypt certificates.

Application Installation Process¶

Deployment is performed by creating the /root/splunk working directory, generating the compose.yml file, and starting containers via Docker Compose. The application uses current images from Docker Hub.

Docker Containers and Execution¶

The application consists of two containers managed via Docker Compose:

nginx

Image name: jonasal/nginx-certbot:latest
Ports: 80:80, 443:443
Volumes:
- nginx_secrets:/etc/letsencrypt
- /data/nginx/user_conf.d:/etc/nginx/user_conf.d
Environment variables: [email protected]
Restart policy: unless-stopped

splunk

Image name: splunk/splunk:latest
Ports: 8000:8000
Environment variables:
- SPLUNK_START_ARGS: "--accept-license"
- SPLUNK_PASSWORD: <user password>
Restart policy: unless-stopped

Application Update¶

Updates are performed by running pull commands and restarting the containers:

docker compose pull && docker compose up -d

Permissions Settings¶

Access rights for system directories:

Directory /root/splunk: owner root, group root, mode 0644.

Configuration Files and Data Location¶

Nginx configuration files are located in /data/nginx/user_conf.d/. Application data is stored within Docker volumes or in the corresponding directories specified in the volume parameters.

Available Ports for Connection¶

Port	Purpose
80	HTTP (for SSL acquisition)
443	HTTPS (primary access via web interface)
8000	Direct access to Splunk API/Web

Starting and Stopping the Application¶

Service management is performed using Docker Compose from the /root/splunk directory:

Start:

docker compose up -d

Stop:

docker compose down