Description of problem:

Customer configured splunk as a logging driver in docker:

OPTIONS=' --selinux-enabled --insecure-registry=172.30.0.0/16 --log-driver=splunk --log-opt splunk-url=http://splunk_url:8088 --log-opt splunk-token=splunk_toke --log-opt tag="{{.Name}};{{.ImageName}}" --log-opt splunk-index=docker

When he switched back to journald and then back to the splunk, then the splunk is not working.
Also customer asked if they are locally saved before send to splunk.

Also the logs from docker are not visible from default project, but from different namespace it is.  

Version-Release number of selected component (if applicable):

OpenShift Container Platform 3.3.1.3

How reproducible:

not reproducible


Expected results:

switching through different drivers should work

Additional info:

switch to journald and back to is not working