Split logs in more indexes with Splunk OTEL Collector for Kubernetes and Splunk Cloud

[giacomomiceli]

Hello,
We are investigating if we can install with helm Splunk OpenTelemetry Collector for Kubernetes to collect and ingest our logs to Splunk Cloud.
We would like to split the system log from the other logs into two different indexes. Reading the documentation I saw that it is possible to indicate the index as an annotation in the namespaces or pods, but in the values.yaml of the helm the index field is required, but it seems to be usable for only one index.
In summary we will want to use two different indexes, setting one as default and the other using namespace annotations.
Could you kindly show me a configuration for our problem?

[tscroggins]

Hi,

Ingest actions may be the simplest solution.

For each source type, e.g. kube:container:container1, create an ingest action with a "Set Index" rule and set the value to the target index.

If you need to route events with the same source type to different indexes, you can add a regular expression or eval-based condition to match content within the events and chain together multiple Set Index rules.

More information is available at https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/DataIngest#Set_index.