Splunk-Enterprise

Official

Overview

Splunk Enterprise from the official splunk/splunk image, as a single standalone instance: search, dashboards and alerts over logs and machine data. Receives data from Splunk Universal Forwarders (port 9997), over the HTTP Event Collector (port 8088) or from files you add in the web UI (port 8000). You must accept the Splunk General Terms and the license (two variables below) and set an admin password of at least 8 characters before the first start. Without a license file Splunk runs as a 60-day trial and then as Splunk Free (500 MB of data per day). To install a specific version, replace "latest" in the repository with a tag such as splunk/splunk:10.2.6. The first start takes a few minutes.

Readme

View on GitHub

Splunk Enterprise for Unraid

A single standalone Splunk Enterprise instance from the official splunk/splunk image.

Template: splunk-enterprise.xml.

Before the first start

The container refuses to start until all three are set:

Variable	Value
`SPLUNK_START_ARGS`	`--accept-license`
`SPLUNK_GENERAL_TERMS`	`--accept-sgt-current-at-splunk-com`
`SPLUNK_PASSWORD`	admin password, at least 8 characters

Entering the two flags means you accept the Splunk General Terms and the Splunk Enterprise license. The password is only applied on the first start; change it later in the web UI (Settings, Users).

The first start takes a few minutes while the image's Ansible setup runs. The Docker tab shows health: starting until Splunk is ready. Then log in at http://SERVER-IP:8000 as admin.

Version

The template uses splunk/splunk:latest. To pin a version, set the repository to a tag such as splunk/splunk:10.2.6. Upgrading to a newer tag works in place: Splunk migrates etc and var on the next start. Going back to an older version is not supported, so back up both folders first.

Ports

Port	Use
8000	Splunk Web
8089	REST API / management (HTTPS)
9997	Receiving from Universal Forwarders
8088	HTTP Event Collector (HTTPS)

If 8088 is already used on the server, change only the host side. HEC tokens are created in Settings, Data inputs, HTTP Event Collector.

Storage

etc (/opt/splunk/etc): configuration, apps, users. Small.
var (/opt/splunk/var): the indexes. Grows with the indexed data volume, so place it on a pool with enough room. The default retention is roughly 6 years or 500 GB per index; set frozenTimePeriodInSecs / maxTotalDataSizeMB in indexes.conf to limit it.

License

Without a license file Splunk Enterprise runs as a 60-day trial with all features, then you can switch to Splunk Free (500 MB of indexed data per day, no users or alerts) in Settings, Licensing. Upload a purchased or developer license there as well.

Notes

--ulimit nofile=65536 is set in Extra Parameters because Splunk warns about a low open-file limit otherwise.
--stop-timeout 120 gives Splunk time to shut down cleanly; Docker's default 10 s can cut off index writes.
This template is not affiliated with Splunk. Splunk is a registered trademark of its owner.

Requirements

Accept the Splunk General Terms and license (variables below) and set an admin password. About 4 GB of RAM and fast storage for the index.

Related apps

Explore more like this

Explore all

Utilities apps Productivity

Links

Projectsplunk.com Supportgithub.com Docker Hubhub.docker.com Templateraw.githubusercontent.com

Details

Repository

splunk/splunk:latest

Registry

https://hub.docker.com/r/splunk/splunk

Last Updated2026-10-30

First Seen2026-11-14

Runtime arguments

Web UI: http://[IP]:[PORT:8000]/
Network: bridge
Shell: bash
Privileged: false
Extra Params: --ulimit nofile=65536:65536 --stop-timeout 120

Template configuration

Web UI portPorttcp

Splunk Web.

Target: 8000
Default: 8000
Value: 8000

Management portPorttcp

REST API and management (HTTPS). Deployment server and the splunk CLI use it.

Target: 8089
Default: 8089
Value: 8089

Forwarder receiving portPorttcp

Data from Splunk Universal Forwarders. Receiving on 9997 is enabled automatically.

Target: 9997
Default: 9997
Value: 9997

HTTP Event Collector portPorttcp

HTTP Event Collector (HTTPS). Change the host side if 8088 is taken on your server. Create tokens in Settings, Data inputs, HTTP Event Collector.

Target: 8088
Default: 8088
Value: 8088

ConfigPathrw

Splunk configuration, apps and users (/opt/splunk/etc).

Target: /opt/splunk/etc
Default: /mnt/user/appdata/splunk-enterprise/etc
Value: /mnt/user/appdata/splunk-enterprise/etc

DataPathrw

Indexes and internal logs (/opt/splunk/var). Grows with the amount of data you index; put it on a pool with enough space.

Target: /opt/splunk/var
Default: /mnt/user/appdata/splunk-enterprise/var
Value: /mnt/user/appdata/splunk-enterprise/var

Admin passwordVariable

Password for the user admin, at least 8 characters. Only used on the first start; change it later in the web UI.

Target: SPLUNK_PASSWORD

Accept licenseVariable

Enter --accept-license to accept the Splunk Enterprise license. The container does not start without it.

Target: SPLUNK_START_ARGS

Accept Splunk General TermsVariable

Enter --accept-sgt-current-at-splunk-com to accept the Splunk General Terms (https://www.splunk.com/en_us/legal/splunk-general-terms.html).

Target: SPLUNK_GENERAL_TERMS

Time zoneVariable

Time zone of the container, e.g. Europe/Berlin.

Target: TZ
Default: Etc/UTC
Value: Etc/UTC

Library

Curated

Categories