- create defaults file
docker run -it -e SPLUNK_PASSWORD={password} splunk/splunk:latest create-defaults > default.yml
- build
docker-compose -f {filename.yml} up -d
- teardown
docker-compose -f {filename.yml} down
splunk SVA M4:
- 1 x multi-site IDXC
- site1
- 2 x IDX
- site2
- 2 x IDX
- site1
- 1 x SHC
- 5 x SH
- 1 x deployer
3-node cribl cluster:
- 1 x leader-node
- 2 x worker-node
{+ update mapped paths to apps per your environment +}
splunk SVA S11:
- 1 x standalone instance
- 1 x enterprise security 6.6.0
- 1 x eventgen 7.2.1
- 1 x BOTS v3
- 1 x unix TA 8.3.1
- 1 x tenable TA 5.2.0