Splunk Dev

Kubernetes/OpenShift Splunk Connect: How to send logs from specific namespace to an index?

catherinelam
Explorer

I have a Splunk Connect instance on my OpenShift cluster that's currently sending all logs to a logging index. There's no special configuration and the only tweeking done after installation is pointing to the right Splunk instance / applying the HEC token value. 

Is there a way to set the config map such that all logs from a namespace (i.e. 'specificApplication') goes to an index?

Here's a snippet of what the current config map for logging looks like - not sure if this would shed insight as I'm not too familiar with Splunk:

      <match **>
        @type splunk_hec
        protocol http
        hec_host "xx.x.xx.xx"
        hec_port 8088
        hec_token "#{ENV['SPLUNK_HEC_TOKEN']}"
        index_key index
        #insecure_ssl true
        host "#{ENV['K8S_NODE_NAME']}"
        source_key source
        sourcetype_key sourcetype
0 Karma

mattymo
Splunk Employee
Splunk Employee

Yes, connect for Kubernetes supports the use of annotations to route data. Please ensure to use the latest, currently 1.4.6 at time of writing this. 

https://github.com/splunk/splunk-connect-for-kubernetes#managing-sck-log-ingestion-by-using-annotati...

 

 

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...