splunkhecexporter

README

Splunk HTTP Event Collector (HEC) Exporter

How to send metrics to a Splunk HEC endpoint.

Supported pipeline types: logs, metrics, traces

🚧 This receiver is in beta and configuration fields are subject to change.

Configuration

The following configuration options are required:

• token (no default): HEC requires a token to authenticate incoming traffic.
• endpoint (no default): Splunk HEC URL.

The following configuration options can also be configured:

• source (no default): Optional Splunk source: https://docs.splunk.com/Splexicon:Source
• sourcetype (no default): Optional Splunk source type: https://docs.splunk.com/Splexicon:Sourcetype
• index (no default): Splunk index, optional name of the Splunk index targeted
• max_connections (default: 100): Maximum HTTP connections to use simultaneously when sending data.
• disable_compression (default: false): Whether to disable gzip compression over HTTP.
• timeout (default: 10s): HTTP timeout when sending data.
• insecure_skip_verify (default: false): Whether to skip checking the certificate of the HEC endpoint when sending data over HTTPS.

In addition, this exporter offers queued retry which is enabled by default. Information about queued retry configuration parameters can be found here.

Example:

exporters:
  splunk_hec:
    # Splunk HTTP Event Collector token.
    token: "00000000-0000-0000-0000-0000000000000"
    # URL to a Splunk instance to send data to.
    endpoint: "https://splunk:8088/services/collector"
    # Optional Splunk source: https://docs.splunk.com/Splexicon:Source
    source: "otel"
    # Optional Splunk source type: https://docs.splunk.com/Splexicon:Sourcetype
    sourcetype: "otel"
    # Splunk index, optional name of the Splunk index targeted.
    index: "metrics"
    # Maximum HTTP connections to use simultaneously when sending data. Defaults to 100.
    max_connections: 200
    # Whether to disable gzip compression over HTTP. Defaults to false.
    disable_compression: false
    # HTTP timeout when sending data. Defaults to 10s.
    timeout: 10s
    # Whether to skip checking the certificate of the HEC endpoint when sending data over HTTPS. Defaults to false.
    insecure_skip_verify: false

The full list of settings exposed for this exporter are documented here with detailed sample configurations here.

This exporter also offers proxy support as documented here.

Documentation

Overview

Package splunkhecexporter implements an exporter that sends data to Splunk.

Index

• func NewFactory() component.ExporterFactory
• type Config

Functions

func NewFactory

func NewFactory() component.ExporterFactory

NewFactory creates a factory for Splunk HEC exporter.

Types

type Config

type Config struct {
	configmodels.ExporterSettings  `mapstructure:",squash"` // squash ensures fields are correctly decoded in embedded struct.
	exporterhelper.TimeoutSettings `mapstructure:",squash"` // squash ensures fields are correctly decoded in embedded struct.
	exporterhelper.QueueSettings   `mapstructure:"sending_queue"`
	exporterhelper.RetrySettings   `mapstructure:"retry_on_failure"`

	// HEC Token is the authentication token provided by Splunk.
	Token string `mapstructure:"token"`

	// URL is the Splunk HEC endpoint where data is going to be sent to.
	Endpoint string `mapstructure:"endpoint"`

	// Optional Splunk source: https://docs.splunk.com/Splexicon:Source.
	// Sources identify the incoming data.
	Source string `mapstructure:"source"`

	// Optional Splunk source type: https://docs.splunk.com/Splexicon:Sourcetype.
	SourceType string `mapstructure:"sourcetype"`

	// Splunk index, optional name of the Splunk index.
	Index string `mapstructure:"index"`

	// MaxConnections is used to set a limit to the maximum idle HTTP connection the exporter can keep open. Defaults to 100.
	MaxConnections uint `mapstructure:"max_connections"`

	// Disable GZip compression. Defaults to false.
	DisableCompression bool `mapstructure:"disable_compression"`

	// insecure_skip_verify skips checking the certificate of the HEC endpoint when sending data over HTTPS. Defaults to false.
	InsecureSkipVerify bool `mapstructure:"insecure_skip_verify"`
}

Config defines configuration for Splunk exporter.