Splunk Cloud Platform

Exclude unnecessary logs being sent to splunk cloud platform

Vivi
Loves-to-Learn Lots

I am using the Splunk OTEL Collector Helm chart to send logs from my GKE pods to the Splunk Cloud Platform. I have set `UsesplunkIncludeAnnotation` to `true` to filter logs from specific pods. This setup was working fine until I tried to filter the logs being sent. I added the following configuration to my `splunk` values.yaml:

  config:
    processors:
      filter/ottl:
        error_mode: ignore
        logs:
          log_record:
            - 'IsMatch(body, "GET /status")'
            - 'IsMatch(body, "GET /healthcheck")'

When I applied this configuration, the specified logs were excluded as expected, but it did not filter logs from the specified pods. I am still receiving logs from all my pods, and the annotation is not taking effect. Additionally, the host is not displaying correctly and is showing as "unknown". (I will attach a screenshot for reference.)

Vivi_0-1721651557628.png

My questions are:
1. How can I exclude these specific logs more effectively?
2. Is there a more efficient way to achieve this filtering?

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...