missing collector service in HEC services list

[Eshwar]

Hi Splunk Experts,

I had configured HEC and tried to send logs data via OTEL collector but I don't find service for collector. So, kindly suggest how to enable collector service to receive data from OTEL Collector.

Much appreciated for your inputs.

Regards,

Eshwar

[Eshwar]

Hi @sainag_splunk 

I have reconfigured HEC and I am able to send data to HEC indexer via Post man. Since, I had configured OTEL collector according to HEC but I am not able to see data from OTEL collector. Can you please suggest where went wrong.

Thank you in advance.

Regards,

Eshwar

[sainag_splunk]

Hello, it should be port 8088 in your script, however UI won't work, for the HEC.

 Try to sending the data to HEC via Postman or curl, if that works, then it should be an issue on the payload data source.

For troubleshooting: use the below search for your hec logs.

index=_introspection component=HttpEventCollector sourcetype=http_event_collector_metrics

index=_internal host=yourhechost ERROR

Last thing try to use the services/collector/raw endpoint to test, but keep in mind to use services/collector/event for your json data.

Hope this helps. 

[sainag_splunk]

Did you already try this ? please refer: https://github.com/signalfx/splunk-otel-collector-chart/tree/main?tab=readme-ov-file

helm install my-splunk-otel-collector --set="splunkPlatform.endpoint=https://127.0.0.1:8088/services/collector,splunkPlatform.token=xxxxxx,splunkPlatform.metricsIndex=k8s-metrics,splunkPlatform.index=main,clusterName=my-cluster" splunk-otel-collector-chart/splunk-otel-collector

[Eshwar]

Hi @sainag_splunk ,

Thank you for your response.

Just for your info I had installed HEX on on-prem not on Kubernetes. I think that command you have shared is for Kubernetes environment.

My goal is to achieve sending log data through Otel collector to HEC end point.

[sainag_splunk]

If you already have HEC setup with the token, index. You should be good on the splunk indexing side. 

You will need to use HEC exporter.

HEC exporter: https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/splunkhecexport...

Refer:  https://github.com/signalfx/splunk-otel-collector/tree/main/examples/otel-logs-splunk

Hope all these links help. 

[Eshwar]

Hi @sainag_splunk ,

Yes, I had configured with token, index. Below is my configuration in HEC and OTEL exporter.

Please suggest where went wrong?

Regards,

Eshwar

[Eshwar]

Hi @sainag_splunk ,

I am trying to open the end point on browser but getting below error.

Regards,

Eshwar