{"severity":"INFO","ts":1704101563.224535,"logger":"controller","msg":"Seccomp profile 'not configured' is not allowed for container 'splunk-fluentd-k8s-objects'. Found at: no explicit profile found. Allowed profiles: {\"RuntimeDefault\", \"docker/default\", \"runtime/default\"}","process":"audit","audit_id":"2024-01-01T09:32:31Z","details":{},"event_type":"violation_audited","constraint_group":"constraints.gatekeeper.sh","constraint_api_version":"v1beta1","constraint_kind":"K8sPSPSeccomp","constraint_name":"cis-k8s-v1.5.1-psp-seccomp-default","constraint_namespace":"","constraint_action":"warn","resource_group":"","resource_api_version":"v1","resource_kind":"Pod","resource_namespace":"idmzct0-ito-utils-splunkdc-callsign","resource_name":"gkeusr-idmzc-dev-tier0-01-splunk-kubernetes-objects-5686d96j7nj","resource_labels":{"app":"splunk-kubernetes-objects","engine":"fluentd","pod-template-hash":"5686d96bd8","release":"gkeusr-idmzc-dev-tier0-01"}} Show syntax highlighted cluster_name = gkeusr-idmzc-dev-tier0-01container_name = managerhost = npool-cos-apps-medium-7b7dd5cdb8-s6lrpnamespace = gatekeeper-systempod = gatekeeper-audit-789888c597-q9vt8severity = INFOsource = /var/log/containers/gatekeeper-audit-789888c597-q9vt8_gatekeeper-system_manager-da5f687a6b53035c4299f8e3c5cc941c510756de883f2f0e68e783cd4edc7191.logsourcetype = kube:container:manager ... View more

I have splunk connect in kubernetes which is responsible for forwarding the logs directly to the indexers using HEC token. Hope this helps!! the props.conf and transforms.conf should be on the indexer layer to process the incoming data from Kubernetes via splunk connect. - this is my understanding ... View more

the same stanzan's is what I had been trying, but no luck 😞 ... View more

Is there a way I can use "namespace" in transforms.conf to seperate the data after using sourcetype in props.conf ... View more

There are no heavy forwarders.. . Below is the summary of things for your understanding.. I've successfully configured Splunk Connect for Kubernetes and are ingesting data into the "events" index. I'd like to redirect this data into more meaningful indexes based on specific field values, such as the "namespace" field. I've been able to achieve rerouting using sourcetype configurations in props.conf and transforms.conf. But using other fields like "namespace" configuration in transform.conf and props.conf file, log data is not redirected to other meaning full indexes. ... View more

My files are located on the indexer/indexer's/cluster-master under "/opt/splunk/etc/apps/appName/local". Yes, it works with sourcetype. However, it seems the sourcetype spec doesn't accept wildcard. [kube:container:*] - is there a way I can make it work? I need every source with "kube:container:<container_name>" to be accepted in props.conf   Secondly, in my transforms.conf , I want to route any event with "namespace="drnt0-retail-sabbnetservices"" to my already existing index created separately to receive this events data. - Please help me with this.    Regards, Yaseen. ... View more

There is none.. However, I was able to make it work with the <source_type>. Any help is much appreciated!! ... View more

Thanks for the response.. @Giuseppe. where do you locate the conf files? The conf files are located at the first full splunk instance that the data pass through. Regarding the REGEX, what I am trying to achieve is data to be routed to the specified index in transforms.conf based on the field name and it's value. In this case, what I am looking for is whenever, there is a <namespace="drnt0-retail-sabbnetservices"> in the data I want the routing to work. Regards, Yaseen.   Regards, Yaseen.     ... View more