Splunk

FLOW provides a pre-configured OpenTelemetry collector for sending logs to Splunk.

In order to deploy this collector you need to enable it in the tenant configuration. You will also need to provide the Splunk token and the index name, which you need to obtain from the Splunk team. Provide the Splunk token as a secret in Vault and reference it in the tenant configuration.

Splunk Secrets

Add the Splunk token as a secret in Vault. In the tenant configuration, reference the secret path and key.

splunkToken:
  path: "/kubernetes/example/test/splunk"
  key: "token"

Splunk Collector

In the tenant configuration, add the following configuration to enable the Splunk collector:

otel:
  splunk_collector:
    enabled: true
    debug: true
    index: "onboarding"

Parameter	Description
enabled	Enable the Splunk collector.
debug	Enable debug mode.
index	The Splunk index to send logs to.