Splunk Dev

Kubernetes/OpenShift Splunk Connect: How to send logs from specific namespace to an index?

catherinelam
Explorer

I have a Splunk Connect instance on my OpenShift cluster that's currently sending all logs to a logging index. There's no special configuration and the only tweeking done after installation is pointing to the right Splunk instance / applying the HEC token value. 

Is there a way to set the config map such that all logs from a namespace (i.e. 'specificApplication') goes to an index?

Here's a snippet of what the current config map for logging looks like - not sure if this would shed insight as I'm not too familiar with Splunk:

      <match **>
        @type splunk_hec
        protocol http
        hec_host "xx.x.xx.xx"
        hec_port 8088
        hec_token "#{ENV['SPLUNK_HEC_TOKEN']}"
        index_key index
        #insecure_ssl true
        host "#{ENV['K8S_NODE_NAME']}"
        source_key source
        sourcetype_key sourcetype
0 Karma

mattymo
Splunk Employee
Splunk Employee

Yes, connect for Kubernetes supports the use of annotations to route data. Please ensure to use the latest, currently 1.4.6 at time of writing this. 

https://github.com/splunk/splunk-connect-for-kubernetes#managing-sck-log-ingestion-by-using-annotati...

 

 

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...