Splunk Observability Cloud

Configure Splunk Add-On for OpenTelemetry Collector to use HTTP_PROXY, without affecting other traffick

las
Contributor

Hi.

We are starting to use Splunk Infrastructure monitoring, and want to deploy the Otel-Collector using our existing Splunk infrastructure (Deployment Server).
We would really like to send the Otel data to IM using a HTTP_PROXY, but do not want to change the dataflow for the entire server, so only a local HTTP_PROXY for the otel-collector.

As I read the documentation you need to set environment variables for the entire server and not just the otel-collector process.

Has anyone any experience using HTTP_PROXY and Otel-Collector?

 

Kind regards

las

0 Karma

bishida
Splunk Employee
Splunk Employee

Hi,

I think you can set variables like HTTP_PROXY, HTTPS_PROXY, and NO_PROXY in your splunk-otel-collector.conf file so they only apply to the collector and not the entire server.

0 Karma

bishida
Splunk Employee
Splunk Employee

Oh, wait--I see, you are using the TA. splunk-otel-collector.conf is probably not the place for this scenario. I'll have to look in to this more.

0 Karma

las
Contributor

Hi.

 

Thank you for your effort, I hope you find something.

 

Kind regards

0 Karma

bishida
Splunk Employee
Splunk Employee

OK, here is what I found. The proxy env variables can't be set in inputs.conf because they are not included in the inputs.conf.spec. 

If you want to try a different approach, you might be able to set the proxy env variables in the startup script for the collector. This is not a supported config, but could be worth a try to see if it has the desired effect--and maybe it will lead to other ideas/solutions.

For example, if I was running this on a Linux host, I could try setting HTTPS_PROXY in 

/opt/splunkforwarder/etc/apps/Splunk_TA_otel/linux_x86_64/bin/Splunk_TA_otel.sh (e.g., export HTTPS_PROXY=http://my-proxy:8080 )

 

las
Contributor

Thank you very much for your time and effort.

I have created both a support ticket and an idea.

 

Kind regards

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...