Splunk Enterprise

Open Telemetry Exporter to a Cluster

robertlynch2020
Influencer

Hi -

We have been using OT to send data into a single Splunk install and it is working very well.

I am now looking to move this to production and send the data for my Cluster.

3 indexers, but I am unsure how to tell the exporter to do this?
In a forwarder I would give it the host and post of the 3 indexers, but how do I do this in an exporter?

Configure the exportor
exporters:
otlp/aggregation: # push to the aggregator
endpoint: ${AGGREGATOR_HOST}:${AGGREGATOR_PORT}
insecure: true
splunk_hec: # pushed to splunk
token: "a04daf32-68b9-48b2-88a0-6ac53b3ec002"
endpoint: "https://mx33456vm:8088/services/collector"
source: "mx"
sourcetype: "otel"
index: "metrics_test"
insecur...

Thanks for you help in advance 🙂

Labels (1)
Tags (1)
0 Karma
1 Solution

robertlynch2020
Influencer

IN the end i set up an heavy forwarder and this sent the data to multiple indexers that I had on a cluster

View solution in original post

0 Karma

robertlynch2020
Influencer

IN the end i set up an heavy forwarder and this sent the data to multiple indexers that I had on a cluster

0 Karma

robertlynch2020
Influencer

Or do I just configure one HEC on the cluster and push this on the configuration bundle to all the indexers?

If I do that what is the endpoint - as we are moving from one machine to 3 indexers?

endpoint: "https://mx33456vm:8088/services/collector"

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...