Getting Data In

Sending Opentelemetry collector logs to Splunk

stephen
Observer

Hello team, I want to forward Opentelemetry collector logs to Splunk. I'm not referring to sending application logs to Splunk using Splunk HEC exporter. When you have logging exporter configured on your collector, your terminal shows collector logs such as

 

2021-08-09T12:55:28.110Z	info	healthcheck/handler.go:128	Health Check state change	{"component_kind": "extension", "component_type": "health_check", "component_name": "health_check", "status": "ready"}
2021-08-09T12:55:28.110Z	info	service/service.go:267	Everything is ready. Begin running and processing data.

 

when the collector is ready or

 

2021-08-09T12:55:33.511Z	info	exporterhelper/queued_retry.go:276	Exporting failed. Will retry the request after interval.	{"component_kind": "exporter", "component_type": "otlp", "component_name": "otlp", "error": "failed to push log data via OTLP exporter: rpc error: code = DeadlineExceeded desc = context deadline exceeded", "interval": "4.121551979s"}

 

when the collector fails to export data.

I want to send these collector logs to Splunk. Is there a way to configure the Splunk HEC exporter to capture these collector logs and send it to Splunk?

0 Karma

atoulme
Splunk Employee
Splunk Employee

Hello! You will need to use the Splunk HEC exporter for this purpose: https://github.com/signalfx/splunk-otel-collector/tree/main/examples/otel-logs-splunk

Senior Engineering Manager, Blockchain and DLT
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

July Community Events: Master ITSI 5.0 & Automate Splunk

Struggling with alert fatigue or feeling like you're spending more time on infrastructure maintenance than ...

New Release of Federated Search: Bringing Splunk Analytics to More of Your Data

Organizations today are generating more data than ever and storing it across cloud object stores, data lakes, ...