topic Using HTTP to get data into Splunk, but no host is set? - How do i set the host in Splunk Enterprise

Using HTTP to get data into Splunk, but no host is set? - How do i set the host

robertlynch2020 — Tue, 15 Jun 2021 10:40:18 GMT

Hi -

We are using a hec /HTTP to send data (open telemetry) into Splunk using an exporter -( exporter below)

https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/splunkhecexporter

There does not seem a way to set host!
We can set "source" "source type" etc....but not host.

As a result, host = unknown.

When we try to set a host we get errors. Where do i define it?

Thanks in Advance

Robert

Re: Using HTTP to get data into Splunk, but no host is set? - How do i set the host

robertlynch2020 — Wed, 16 Jun 2021 09:28:49 GMT

This can be solved from the exporter configuration.

We can see from below that we have set host.name - this will send the data as host to Splunk

This worded and thanks.

The file code is below.

receivers:
otlp: # pushed by clients
protocols:
grpc:
endpoint: :${OTLP_RECEIVER_PORT}

processors:
batch:
timeout: 1s
resource:
attributes:
key: host.name
value: "TEST1"
action: insert

exporters:
prometheus: # pulled by prometheus
endpoint: :${PROMETHEUS_EXPORTER_PORT}
splunk_hec: # pushed to splunk
token: "a04daf32-68b9-48b2-88a0-6ac53b3ec002"
endpoint: "https://mx33456vm:8088/services/collector"
source: "mx"
sourcetype: "otel"
index: "metrics_test"
insecure_skip_verify: true
splunk_hec/events: # pushed to splunk
token: "a04daf32-68b9-48b2-88a0-6ac53b3ec002"
endpoint: "https://mx33456vm:8088/services/collector"
source: "mx"
sourcetype: "otel"
index: "events_test"
insecure_skip_verify: true

service:
pipelines:
metrics:
receivers: [otlp]
processors: [batch,resource]
exporters: [prometheus,splunk_hec,splunk_hec/events]

Re: Using HTTP to get data into Splunk, but no host is set? - How do i set the host

Hemnaath — Tue, 19 Oct 2021 07:04:47 GMT

Hi Robert,

Need some inputs from you on implementing the open telemetry data in splunk, We wanted to do POC for our client and wanted to ingest open telemetry data logs and trace into splunk and I have following questions?

Is it possible to do them in Splunk Enterprise trail license? Or Do we need to buy Splunk Observability module to monitor the open telemetry data?
Can we use universal forwarder to collect the logs and trace or do we need to have the Splunk OpenTelemetry Connector?
Share the link or document to ingest the open telemetry data logs into splunk.

Could you please guide me on this .

Re: Using HTTP to get data into Splunk, but no host is set? - How do i set the host

robertlynch2020 — Tue, 19 Oct 2021 08:29:52 GMT

Is it possible to do them in Splunk Enterprise trail license? Or Do we need to buy Splunk Observability module to monitor the open telemetry data?
[RL] You can get a 10GB dev license or a 50GB - However, some are available depending on if you are a customer or not. But this is definitely a free Splunk license to get you started
Can we use a universal forwarder to collect the logs and trace or do we need to have the Splunk OpenTelemetry Connector?
[RL] In our case we did not use the UF as we developed an exporter to send it directly to Splunk via HTTP event collector.
Share the link or document to ingest the open telemetry data logs into splunk.
[RL] I will have to come back to you on this, as i cant fully remember where i got this from

Re: Using HTTP to get data into Splunk, but no host is set? - How do i set the host

Hemnaath — Tue, 19 Oct 2021 08:36:03 GMT

thanks Robert for quick response on this, I had posted many questions regarding the same in Splunk answers.com but no one had responded back.

Please guide me on the same on getting the open telemetry data in splunk.

Re: Using HTTP to get data into Splunk, but no host is set? - How do i set the host

Hemnaath — Mon, 25 Oct 2021 05:24:32 GMT

Hi Robert,

We are doing a POC for our client, as per the client we wanted to ingest for ForgeRock open telemetry data into Splunk. For POC purpose we have installed the ForgeRock application and Splunk application are running in the google cloud instance machine (Trial version) but not sure how to on-board the data in to splunk. So could please provide me some heads-up on how to ingest the ForgeRock event data, metric and log into splunk. Kindly share documents are steps which you had referred for ingesting the data in splunk.

thanks