https://community.splunk.com/t5/Splunk-Search/How-do-I-send-Kubernetes-Node-name-to-Splunk/m-p/447449#M174113 <P>We are running a Kubernetes cluster and are shipping pod logs to Splunk Cloud. </P> <P>Our current setup:<BR /> 1. Universal forwarders are deployed as Daemonset, which monitors <CODE>/var/log/containers/*</CODE>. Sample from <CODE>inputs.conf</CODE>:<BR /> <CODE>[monitor:///var/log/containers/kube*.log]</CODE><BR /> <CODE>host_regex = /var/log/containers/(.*)_.*_.*\.log</CODE><BR /> <CODE>sourcetype = kube-state</CODE><BR /> <CODE>index = kepler-dev</CODE><BR /> 2. The Universal forwarders send data to heavy forwards which applies some regex <BR /> 3. Heavy forwarders send data to Splunk Cloud for indexing</P> <P>I want to send the hostname of the worker node either as part of the host or a separate field. Is there a way I can achieve this?</P> Fri, 14 Dec 2018 20:14:33 GMT catchaj88 2018-12-14T20:14:33Z https://community.splunk.com/t5/Splunk-Search/How-do-I-send-Kubernetes-Node-name-to-Splunk/m-p/447449#M174113 <P>We are running a Kubernetes cluster and are shipping pod logs to Splunk Cloud. </P> <P>Our current setup:<BR /> 1. Universal forwarders are deployed as Daemonset, which monitors <CODE>/var/log/containers/*</CODE>. Sample from <CODE>inputs.conf</CODE>:<BR /> <CODE>[monitor:///var/log/containers/kube*.log]</CODE><BR /> <CODE>host_regex = /var/log/containers/(.*)_.*_.*\.log</CODE><BR /> <CODE>sourcetype = kube-state</CODE><BR /> <CODE>index = kepler-dev</CODE><BR /> 2. The Universal forwarders send data to heavy forwards which applies some regex <BR /> 3. Heavy forwarders send data to Splunk Cloud for indexing</P> <P>I want to send the hostname of the worker node either as part of the host or a separate field. Is there a way I can achieve this?</P> Fri, 14 Dec 2018 20:14:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-send-Kubernetes-Node-name-to-Splunk/m-p/447449#M174113 catchaj88 2018-12-14T20:14:33Z https://community.splunk.com/t5/Splunk-Search/How-do-I-send-Kubernetes-Node-name-to-Splunk/m-p/447450#M174114 <P>I would highly suggest looking for the alternatives for forwarding Kubernetes logs to Splunk:</P> <UL> <LI>Open Source Free version of <A href="https://github.com/splunk/splunk-connect-for-kubernetes">Splunk Connect for Kubernetes</A> - this is a recommended by Splunk option for forwarding logs, built on top of FluentD.</LI> <LI><A href="https://www.outcoldsolutions.com">Monitoring Kubernetes with Collectord</A> by Outcold Solutions (I represent this company) - this is a proprietary software, takes 10 minutes to set up to forward logs and collect metrics. This is a complete solution for forwarding container, application, host logs, monitor performance of containers and health of the clusters.</LI> </UL> Mon, 17 Dec 2018 17:09:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-send-Kubernetes-Node-name-to-Splunk/m-p/447450#M174114 outcoldman 2018-12-17T17:09:11Z