topic Re: Splunk and openshift integration flow in Other Usage

Splunk and openshift integration flow

poojabolla — Fri, 08 Mar 2024 17:03:40 GMT

i have splunk index configured in my openshift cluster as a configmap, now if i change the index on the cluster still my container logs are moving to the old index. is there something i am missing?

Re: Splunk and openshift integration flow

kiran_panchavat — Sat, 09 Mar 2024 11:32:14 GMT

@poojabolla Hi Pooja, the index names on the source (open shift) and destination (Splunk) should match. Therefore, the index should only contain the data. Open shift logs should not be sent to Splunk if the index name differs.

Re: Splunk and openshift integration flow

poojabolla — Mon, 11 Mar 2024 18:43:00 GMT

But what if the splunk index itself is missing in splunk, wont it give me any error while writing the queries to retrieve the data?

Re: Splunk and openshift integration flow

kiran_panchavat — Tue, 12 Mar 2024 02:29:38 GMT

@poojabolla Hello Pooja, If you reference an index that does not exist in your Splunk environment, you will receive an error message similar to: “Error in ‘Search’: The specified index does not exist.” Even a small typo in the index name can lead to errors. Make sure you’ve spelled the index name correctly.

https://docs.splunk.com/Documentation/Splunk/9.2.0/Troubleshooting/Cantfinddata