docker-compose-withuf.yml

# must accept EULA the first time that the image is started
# docker run splunk/splunk
# Options on how to review the EULA and accept it: 
# 1. docker run -it splunk/splunk
# 2. Add the following environment variable: SPLUNK_START_ARGS=--accept-license
# e.g., docker run -e "SPLUNK_START_ARGS=--accept-license" splunk/splunk 

# Support for Docker Compose, https://docs.docker.com/compose/overview/
version: '3'
services:
  splunkenterprise:
    #build: .
    hostname: splunkenterprise
    image: splunk/splunk:7.0.3-monitor
    environment:
      SPLUNK_START_ARGS: --accept-license --answer-yes
      SPLUNK_ENABLE_LISTEN: 9997
      SPLUNK_ADD: tcp 1514
    volumes:
      - vsplunk-opt-splunk-etc:/opt/splunk/etc
      - vsplunk-opt-splunk-var:/opt/splunk/var
    ports:
      - "8000:8000"
      - "9997:9997"
      - "8088:8088"
      - "1514:1514"
  splunkuniversalforwarder:
#    build: .
    hostname: splunkuniversalforwarder
    image: splunk/universalforwarder:7.0.3-monitor
    environment:
      SPLUNK_START_ARGS: --accept-license --answer-yes
      SPLUNK_FORWARD_SERVER: splunkenterprise:9997
      SPLUNK_USER: root
    volumes:
      - vsplunkuf-opt-splunk-etc:/opt/splunk/etc
      - vsplunkuf-opt-splunk-var:/opt/splunk/var      
      - /var/lib/docker/containers:/host/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    links:
      - splunkenterprise
    
volumes:
  vsplunk-opt-splunk-etc:
  vsplunk-opt-splunk-var:
  vsplunkuf-opt-splunk-etc:
  vsplunkuf-opt-splunk-var: