Chapter 4. Forward to Splunk

Procedure

1. Create a secret using your Base64 encoded Splunk HEC token.

   $ oc -n openshift-logging create secret generic splunk-secret --from-literal hecToken=<HEC_Token>

2. Create or edit the ClusterLogForwarder Custom Resource (CR) using the template below:

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: <log_forwarder_name>
     namespace: openshift-logging
   spec:
     serviceAccount:
       name: <service_account_name>
     outputs:
       - name: splunk-receiver
         type: splunk
         splunk:
           url: '<http://your.splunk.hec.url:8088>'
           authentication:
             token:
               secretName: splunk-secret
               key: hecToken
           index: '{.log_type||"undefined"}'
           source: '{.log_source||"undefined"}'
           indexedFields: ['.log_type', '.log_source']
           payloadKey: '.kubernetes'
           tuning:
               compression: gzip
     pipelines:
       - name: my-logs
         inputRefs:
           - application
           - infrastructure
         outputRefs:
           - splunk-receiver

   serviceAccount.name

   The name of your service account.

   outputs.name

   Specify a name for the output.

   type

   Specify the output type as splunk.

   key

   Specify the name of the secret that has your HEC token.

   url

   Specify the URL, including port, of your Splunk HEC.

   index

   Specify the name of the index to send events to. If you do not specify an index, the Splunk server uses its default index. This is an optional field.

   source

   Specify the source of events to send to this sink. You can configure dynamic per-event values. This field is optional. If you do not specify a value, the log_type and log_source values determine the value of the field. For example, see Default Splunk metadata key values.

   indexedFields

   Specify the fields to add to the Splunk index. This field is optional. The index stores the values directly alongside the raw event data, allowing for faster search performance on those fields. However, indexed_fields fields increase storage use. Use them only for high-value fields that give significant search benefits, for example, large datasets with frequent queries on specific fields. You can use complex and nested fields as indexed fields. These are automatically transformed to meet Splunk’s requirements.

   payloadKey

   Specify the record field to use as the payload. By default, the payloadKey field is not set, which means the collector forwards the complete log record as the payload. Use the payloadKey field carefully. Selecting a single field as the payload might drop other important information in the log, potentially leading to inconsistent or incomplete log events.

   compression

   Specify the compression configuration, which can be either gzip or none. The default value is none. This field is optional.

   inputRefs

   Specify the input names.

   receiver

   Specify the name of the output to use when forwarding logs with this pipeline.