Splunk Dev

Kubernetes/OpenShift Splunk Connect: How to send logs from specific namespace to an index?

catherinelam
Loves-to-Learn

I have a Splunk Connect instance on my OpenShift cluster that's currently sending all logs to a logging index. There's no special configuration and the only tweeking done after installation is pointing to the right Splunk instance / applying the HEC token value. 

Is there a way to set the config map such that all logs from a namespace (i.e. 'specificApplication') goes to an index?

Here's a snippet of what the current config map for logging looks like - not sure if this would shed insight as I'm not too familiar with Splunk:

      <match **>
        @type splunk_hec
        protocol http
        hec_host "xx.x.xx.xx"
        hec_port 8088
        hec_token "#{ENV['SPLUNK_HEC_TOKEN']}"
        index_key index
        #insecure_ssl true
        host "#{ENV['K8S_NODE_NAME']}"
        source_key source
        sourcetype_key sourcetype
Labels (1)
0 Karma

mattymo
Splunk Employee
Splunk Employee

Yes, connect for Kubernetes supports the use of annotations to route data. Please ensure to use the latest, currently 1.4.6 at time of writing this. 

https://github.com/splunk/splunk-connect-for-kubernetes#managing-sck-log-ingestion-by-using-annotati...

 

 

- MattyMo
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...