Splunk add-on for Google Cloud Platform How to add logs/new Input to have Kubernetes Pod Status?

[Cheng2Ready]

Splunk add-on for Google Cloud Platform How to add logs/new Input to have Kubernetes Pod Status?

What are the steps?
How to add new Input to have Kubernetes Pod Status(highlight below GCP picture of Pods) into Splunk?

[PickleRick]

Splunk-build Add-ons usually have pretty decent docs. Did you read this one?

https://splunk.github.io/splunk-add-on-for-google-cloud-platform/

[Cheng2Ready]

@PickleRick Thank you for the prompt response.

I still don't see how I can get the Status in GCP for the Kubernetes pods?

[Cheng2Ready]

Hi @PickleRick I don't see anyAPI GET that shows Pod or Status any help/ guidance would be appreciated.

[PickleRick]

If there is no such input to choose from it might indeed be the case that there is no direct possibility to capture pods status. Which wouldn't be that surprising since Splunk typically deals with logs and logs usually contain transitions between states, not states themselves.

You could probably write your own scrpited input to periodically call proper API endpoint to capture those states and ingest it into Splunk but that requires some development on your side.