Splunk Cloud Platform

Split logs in more indexes with Splunk OTEL Collector for Kubernetes and Splunk Cloud

giacomomiceli
New Member

Hello,
We are investigating if we can install with helm Splunk OpenTelemetry Collector for Kubernetes to collect and ingest our logs to Splunk Cloud.
We would like to split the system log from the other logs into two different indexes. Reading the documentation I saw that it is possible to indicate the index as an annotation in the namespaces or pods, but in the values.yaml of the helm the index field is required, but it seems to be usable for only one index.
In summary we will want to use two different indexes, setting one as default and the other using namespace annotations.
Could you kindly show me a configuration for our problem?

Labels (2)
0 Karma

tscroggins
Influencer

Hi,

Ingest actions may be the simplest solution.

For each source type, e.g. kube:container:container1, create an ingest action with a "Set Index" rule and set the value to the target index.

tscroggins_0-1696819762429.png

If you need to route events with the same source type to different indexes, you can add a regular expression or eval-based condition to match content within the events and chain together multiple Set Index rules.

More information is available at https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/DataIngest#Set_index.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...