All Apps and Add-ons

When "indexRouting" is set to "true", are only logs sent to HEC for which an corresponding index exists?

crdn
New Member

In Splunk Connect for Kubernetes Configuration, there is a parameter called "indexRouting".

splunk:
hec:

indexRouting: true

When "indexRouting" is set to "true", Splunk Connect sends the logs of a Kubernetes namespace to an index wich has the identical name as the namespace.

We only want to send the logs of specific namespaces to Splunk. So my question ist: Does Splunk Connect check if a corresponding index exists, before it sends all the logs of a namespace to Splunk?

In Splunk, only the logs of namespaces with a corresponding index are stored. So it makes no sense, to send the logs of namespaces, for which no corresponding index exists, to Splunk (over the network).

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

HEC sender cannot check is the index exists on the receiver.
and HEC receiver dump events if the index does not exist, or if the token does not have permissions to ingest to the index.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

HEC sender cannot check is the index exists on the receiver.
and HEC receiver dump events if the index does not exist, or if the token does not have permissions to ingest to the index.

0 Karma

yannK
Splunk Employee
Splunk Employee

on the indexer side, there is an optional setting for a catch-22 index, but I do not know if the HEC input will use it.

0 Karma

crdn
New Member

@yannK Thank you very much for the hint. Unfortunately I can not find any information about this catch-22 index option. What is the keyword to look after or do you have a link to the corresponding documentation.

0 Karma

rmurali4u
New Member

@crdn i am have also similar requirement. In the K8 there are two namespace client 1 and client2. Each namespace has set of micro-service application running. I want logs of each namespace (client) into a index ( which is same name as namespace). Were you able to solve the issues?

0 Karma

crdn
New Member

@rmurali4u Because I don't want to deviate from the splunk standard, I have opened a feature request. I hope that it will be implemented soon.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...