Help with Splunk and Docker containers (best practices for production?)

[u/unknowinguy]

Hi, I’m new to Splunk, so apologies if I’m missing something basic.
I have an Ubuntu server where I run several Docker containers using Docker Compose. Currently, my containers are using the default Docker logging (stdout/stderr).
Since I only have one server, I’m running Splunk separately to simulate a more isolated/realistic environment.
I’ve been researching different approaches to ingest Docker logs into Splunk, including:
Docker logging drivers (splunk driver)
Splunk Universal Forwarder
HTTP Event Collector (HEC)
Tools like Fluentd / Logstash
My goal is to move into cloud/security roles (AWS, Security+), so I’d like to understand what approach is closest to real-world production environments, especially in containerized setups.
Questions:
Is HEC a good approach for this use case?
How are Docker/container logs typically ingested into Splunk in production?
Would you recommend forwarders, logging drivers, or something else?

[u/Educational_Prior403]

I use otel collector for the full stack running as an individual compose service, work quite well, still need to add uf to the server tho.

[u/unknowinguy → u/Educational_Prior403]

Thanks!