How to send Open Telemetry log signals to Splunk Cloud

[pp219]

Hi,

Our application uses log4j2 logging framework. We are trying to send log signals created by Otel Logs SDK to Splunk cloud platform. Instead of fileReceiver, we want to send these over HTTP.
We are using HTTP Event Collector to send the log records to Splunk Cloud.

Our configuration for HEC exporter in OTEL Collector is:

exporter:
splunk_hec/logs:
token: "<token>"
endpoint: "https://<host>:8088/services/collector/raw"
source: "otel"
index: "logs"
disable_compression: false
tls:
insecure_skip_verify: true
service:
pipelines:
logs:
receivers: [ otlp ]
processors: [ batch]
exporters: [ splunk_hec/logs]

We do see the events being received at Splunk Cloud Platform, but we are not able to query the log data itself.
Can someone guide if this is correct way ? or guide to correct resource.

Thanks!

[marnall]

Are you sure it is supposed to go to the raw event collector at /services/collector/raw ? Unless I am mistaken, you need the export_raw option to be enabled to export raw data for that endpoint.

Try running it with the endpoint set to:

https://<host>:8088/services/collector