= The solution will not configure a Docker container to export container logs to the logging solution, such as Splunk. The command docker system events --filter splunk is not a valid command to send logs to a remote destination. The --filter option for docker system events only accepts the following keys: container, daemon, event, image, label, network, plugin, type, and volume1. splunk is not a valid key for filtering events. To configure a Docker container to export container logs to a logging solution, such as Splunk, you need to use the --log-driver and --log-opt options when creating or running the container2. For example, to use the Splunk logging driver, you can use the following command:
docker run --log-driver=splunk --log-opt splunk-token=176FCEBF-4CF5-4EDF-91BC-703796522D20 --log-opt splunk-url=https://splunkhost:8088 ...
This command will send the container logs to the Splunk HTTP Event Collector (HEC) endpoint specified by the splunk-url option, using the authentication token provided by the splunk-token option3. You can also use other logging drivers, such as syslog, fluentd, gelf, etc., depending on your logging solution4. References:
1: docker system events | Docker Docs
2: Configure logging drivers | Docker Docs
3: Splunk logging driver | Docker Docs
4: Supported logging drivers | Docker Docs
Submit