<p>I have deployed my application image into Kubernetes.</p>
<p>I am trying to send application logs to Splunk. One option would be to use DeamonSet. But, due to some restrictions, I would like to use sidecar.</p>
<p>Is there any sidecar for sending logs from Kubernetes Docker to Splunk?</p>

<p>As you say, you could add a docker container to your pod with a shared volume, for example</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: app-with-sidecar-logs
spec:
  volumes:
  - name: logs
    emptyDir: {}
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: logs
      mountPath: /var/logs
  - name: fluentd
    image: fluent/fluentd
    volumeMounts:
    - name: logs
      mountPath: /var/logs
</code></pre>

<p>You could use the splunk plugin for fluentd configuring and running the docker container properly.</p>

<pre><code>&lt;match pattern&gt;
  type splunk
  host &lt;splunk_host&gt;
  port &lt;splunk_port&gt;
&lt;/match&gt;
</code></pre>

<p>More info:</p>

<p><a href="https://www.fluentd.org/plugins" rel="nofollow noreferrer">https://www.fluentd.org/plugins</a></p>

<p><a href="https://github.com/parolkar/fluent-plugin-splunk" rel="nofollow noreferrer">https://github.com/parolkar/fluent-plugin-splunk</a></p>

<p><a href="https://www.loggly.com/blog/how-to-implement-logging-in-docker-with-a-sidecar-approach/" rel="nofollow noreferrer">https://www.loggly.com/blog/how-to-implement-logging-in-docker-with-a-sidecar-approach/</a> . <strong>Notice this is for loggly, but the idea is the same.</strong></p>
