All Apps and Add-ons

When "indexRouting" is set to "true", are only logs sent to HEC for which an corresponding index exists?

crdn
New Member

In Splunk Connect for Kubernetes Configuration, there is a parameter called "indexRouting".

splunk:
hec:

indexRouting: true

When "indexRouting" is set to "true", Splunk Connect sends the logs of a Kubernetes namespace to an index wich has the identical name as the namespace.

We only want to send the logs of specific namespaces to Splunk. So my question ist: Does Splunk Connect check if a corresponding index exists, before it sends all the logs of a namespace to Splunk?

In Splunk, only the logs of namespaces with a corresponding index are stored. So it makes no sense, to send the logs of namespaces, for which no corresponding index exists, to Splunk (over the network).

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

HEC sender cannot check is the index exists on the receiver.
and HEC receiver dump events if the index does not exist, or if the token does not have permissions to ingest to the index.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

HEC sender cannot check is the index exists on the receiver.
and HEC receiver dump events if the index does not exist, or if the token does not have permissions to ingest to the index.

0 Karma

yannK
Splunk Employee
Splunk Employee

on the indexer side, there is an optional setting for a catch-22 index, but I do not know if the HEC input will use it.

0 Karma

crdn
New Member

@yannK Thank you very much for the hint. Unfortunately I can not find any information about this catch-22 index option. What is the keyword to look after or do you have a link to the corresponding documentation.

0 Karma

rmurali4u
New Member

@crdn i am have also similar requirement. In the K8 there are two namespace client 1 and client2. Each namespace has set of micro-service application running. I want logs of each namespace (client) into a index ( which is same name as namespace). Were you able to solve the issues?

0 Karma

crdn
New Member

@rmurali4u Because I don't want to deviate from the splunk standard, I have opened a feature request. I hope that it will be implemented soon.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...