All Apps and Add-ons

When "indexRouting" is set to "true", are only logs sent to HEC for which an corresponding index exists?

crdn
New Member

In Splunk Connect for Kubernetes Configuration, there is a parameter called "indexRouting".

splunk:
hec:

indexRouting: true

When "indexRouting" is set to "true", Splunk Connect sends the logs of a Kubernetes namespace to an index wich has the identical name as the namespace.

We only want to send the logs of specific namespaces to Splunk. So my question ist: Does Splunk Connect check if a corresponding index exists, before it sends all the logs of a namespace to Splunk?

In Splunk, only the logs of namespaces with a corresponding index are stored. So it makes no sense, to send the logs of namespaces, for which no corresponding index exists, to Splunk (over the network).

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

HEC sender cannot check is the index exists on the receiver.
and HEC receiver dump events if the index does not exist, or if the token does not have permissions to ingest to the index.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

HEC sender cannot check is the index exists on the receiver.
and HEC receiver dump events if the index does not exist, or if the token does not have permissions to ingest to the index.

0 Karma

yannK
Splunk Employee
Splunk Employee

on the indexer side, there is an optional setting for a catch-22 index, but I do not know if the HEC input will use it.

0 Karma

crdn
New Member

@yannK Thank you very much for the hint. Unfortunately I can not find any information about this catch-22 index option. What is the keyword to look after or do you have a link to the corresponding documentation.

0 Karma

rmurali4u
New Member

@crdn i am have also similar requirement. In the K8 there are two namespace client 1 and client2. Each namespace has set of micro-service application running. I want logs of each namespace (client) into a index ( which is same name as namespace). Were you able to solve the issues?

0 Karma

crdn
New Member

@rmurali4u Because I don't want to deviate from the splunk standard, I have opened a feature request. I hope that it will be implemented soon.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...