Getting Data In: Splunk Observability Cloud - Wed 9/18/24

Community Office Hours

Getting Data In: Splunk Observability Cloud - Wed 9/18/24

1 Comment

Published on by adepp | Updated on

Register here. This thread is for the Community Office Hours session on Getting Data In (GDI) to Splunk Observability Cloud on Wed, September 18, 2024 at 1pm PT / 4pm ET.

This is your opportunity to ask questions related to getting data into Splunk Observability Cloud, including:

How to connect cloud services (e.g., AWS, GCP, Azure)
Sending data with the OpenTelemetry Collector
Apps and add-ons to get data in
Instrumenting back-end services, applications, and serverless functions
Converting logs-to-metrics with Ingest Processor (via Splunk Cloud Platform)
Anything else you’d like to learn!

Please submit your questions at registration or as comments below. You can also head to the #office-hours user Slack channel to ask questions (request access here).

Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants.

Look forward to connecting!

Here are a few questions from the session (get the full Q&A deck and live recording in the #office-hours Slack channel):

Q1: What are some new features/solutions for getting data into Splunk Observability Cloud?

Ingest Processor
- Available in Splunk Cloud only (can route to Splunk Observability Cloud)
- Processes data in Splunk Cloud, before shipping to destination(s)
OpenTelemetry Collector (CNCF, second largest project after Kubernetes)
- Open source
- Supports HEC, OTLP
Documentation

Q2: OpenTelemetry demo with Splunk Enterprise (HEC)

Customers can set up the Splunk OpenTelemetry Collector for Kubernetes and send logs to Splunk Enterprise via the HEC exporter.
Documentation:
- https://lantern.splunk.com/Data_Descriptors/Kubernetes/Setting_up_the_OpenTelemetry_Demo_in_Kubernet...
- https://docs.splunk.com/observability/en/gdi/opentelemetry/components/splunk-hec-exporter.html

Q3: Process monitoring via OTel Demo

Customers can use the process list integration with the OpenTelemetry Collector
This enables the reporting of running processes for a host, similar to the output of the top or ps commands
For process metrics, use the host metrics receiver process scraper

Documentation:

Other Questions/Topics (check the #office-hours Slack channel for responses):

I am very new to Ingest Processor. Could you please walk-through with an example from a beginner's perspective?
Can I select multiple source types single pipelines?
Is there a schema for setting metrics over the HEC collector into Splunk?