All Apps and Add-ons

Split kubernetes opentelemetry logs to differents indexes



With have some applications running on kubernetes.
All the logs produced by the application are sent to the standard output of the pod instance.

On those logs, we would like to be able to extract them (based on a pattern for exemple) and send them to a specific index. The others logs would go to a "by default" index.

Can we acheive this with splunk OTEL for kubernetes?
do you have some hints where i should start first ?

thank you


Labels (1)
0 Karma


@Ivansplunk - You can dynamically change metadata (including Index) at the parsing phase of data ingestion.

You can decide based on source, host, raw event content, write regex upon it, and update the index accordingly.

# transforms.conf

[<transforms stanza name>]
SOURCE_KEY = MetaData:Host OR MetaData:Sourcetype OR if you don't add this attribute regex will apply on _raw event data
REGEX = <write regex>
DEST_KEY = _MetaData:Index
FORMAT = Use $1, $2 from regex group to extract dynamic values, otherwise use static string of index name


Reference - 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...