universalforwarder keeps shutting down

Hi

I setup two containers (standalone and universalforwarder) with docker-compose as described in https://splunk.github.io/docker-splunk/EXAMPLES.html#create-standalone-and-universal-forwarder

Splunk standalone runs fine. Universal forwarder however shuts down after a full playbook run. Is it normal?

the docker-compose.yml is just like in the example with added debug env variables:

version: "3.6"

networks:
  splunknet:
    driver: bridge
    attachable: true

services:
  uf1:
    networks:
      splunknet:
        aliases:
          - uf1
    image: ${UF_IMAGE:-splunk/universalforwarder:latest}
    hostname: uf1
    container_name: uf1
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_STANDALONE_URL=so1
      - SPLUNK_ADD=udp 1514, monitor /var/log/*
      - SPLUNK_PASSWORD=TestSplunk
      - DEBUG=true
      - ANSIBLE_EXTRA_FLAGS=-vv
    ports:
      - 8089

  so1:
    networks:
      splunknet:
        aliases:
          - so1
    image: ${SPLUNK_IMAGE:-splunk/splunk:latest}
    hostname: so1
    container_name: so1
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_STANDALONE_URL=so1
      - SPLUNK_PASSWORD=TestSplunk
      - DEBUG=true
      - ANSIBLE_EXTRA_FLAGS=-vv
    ports:
      - 8000
      - 8089

I have attached the logs.
uf1_ansible_vv.log
uf1_splunkd.log

Thanks for any insights!

Start with docker-compose.yml and the linked universal-forwarder example, then inspect uf1_ansible_vv.log and uf1_splunkd.log to identify why uf1 exits after the full playbook run. Done means establishing whether the shutdown is expected and documenting the evidence or reproducible change needed.