Skip to content

Commit f1baee4

Browse files
theashiotopenshift-cherrypick-robot
theashiot
authored and
openshift-cherrypick-robot
committed
OBSDOCS-1808: Honor splunk Event metadata keys
1 parent ac569e2 commit f1baee4

File tree

3 files changed

+92
-6
lines changed

3 files changed

+92
-6
lines changed

‎configuring/configuring-log-forwarding.adoc‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,14 @@ include::modules/enabling-multi-line-exception-detection.adoc[leveloffset=+2]
121121

122122
include::modules/cluster-logging-collector-log-forward-gcp.adoc[leveloffset=+1]
123123

124-
include::modules/logging-forward-splunk.adoc[leveloffset=+1]
124+
[id="forwarding-logs-to-splunk_{context}"]
125+
== Forwarding logs to Splunk
126+
127+
Splunk is a log aggregation service that has a well defined API to make use of its feature set. You can forward logs to Splunk from the `ClusterLogForwarder` Custom Resource (CR).
128+
129+
include::modules/logging-forward-splunk.adoc[leveloffset=+2]
130+
131+
include::modules/default-splunk-metadata-key-values.adoc[leveloffset=+2]
125132

126133
include::modules/logging-http-forward.adoc[leveloffset=+1]
127134

‎modules/default-splunk-metadata-key-values.adoc‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
:_newdoc-version: 2.18.4
2+
:_template-generated: 2025-10-09
3+
:_mod-docs-content-type: REFERENCE
4+
5+
[id="default-splunk-metadata-key-values_{context}"]
6+
= Default Splunk metadata key values
7+
8+
{clo} sets default values for some Splunk metadata keys if you do not configure them in the `spec.output.splunk.source` field of the `ClusterLogForwarder` Custom Resource (CR).
9+
10+
The following table describes the default value that will be used for Splunk metadata, depending on `log_type` and `log_source` attributes.
11+
12+
.Default metadata key values
13+
[cols="1,1,1,1,1"]
14+
|====
15+
|Key
16+
a|Infrastructure Journal
17+
18+
* log_type:infrastructure
19+
* log_source:node
20+
21+
a|Infrastructure or application container
22+
23+
* log_type: infrastructure, application
24+
25+
* log_source:container
26+
27+
a|Audit
28+
29+
* log_type:audit
30+
* log_source: auditd, ovn, openshiftAPI
31+
, kubeAPI
32+
33+
|Note
34+
35+
36+
37+
|`index`
38+
|
39+
|
40+
|
41+
|Not configured by default.
42+
43+
44+
|`source`
45+
|SYSLOG_IDENTIFIER
46+
|ns_name_podName_containerName
47+
|.log_source
48+
|
49+
50+
|`indexedFields`
51+
|
52+
|
53+
|
54+
|Not configured by default.
55+
56+
57+
|`sourceType`
58+
|`_json` or `generic_single_line`
59+
|`_json` or `generic_single_line`
60+
|`_json` or `generic_single_line`
61+
|Determined automatically based on the type of the final event payload.
62+
63+
64+
|`host`
65+
|`.hostname`
66+
|`.hostname`
67+
|`.hostname`
68+
|Not configurable.
69+
70+
|`payloadKey`
71+
|
72+
|
73+
|
74+
|Not configured by default.
75+
|====

‎modules/logging-forward-splunk.adoc‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
// * configuring/configuring-log-forwarding.adoc
44

55
:_mod-docs-content-type: PROCEDURE
6-
[id="logging-forward-splunk_{context}"]
7-
= Forwarding logs to Splunk
6+
[id="logging-forward-splunk-http-event-collector_{context}"]
7+
= Forwarding logs to Splunk HTTP Event Collector
88

99
You can forward logs to the Splunk HTTP Event Collector (HEC).
1010

@@ -63,9 +63,13 @@ spec:
6363
<4> Specify the name of the secret that contains your HEC token.
6464
<5> Specify the URL, including port, of your Splunk HEC.
6565
<6> Specify the name of the index to send events to. If you do not specify an index, the default index of the splunk server configuration is used. This is an optional field.
66-
<7> Specify the source of events to be sent to this sink. You can configure dynamic per-event values. This field is optional.
67-
<8> Specify the fields to be added to the Splunk index. This field is optional.
68-
<9> Specify the record field to be used as the payload. This field is optional.
66+
<7> Specify the source of events to be sent to this sink. You can configure dynamic per-event values. This field is optional. If you do not specify a value, the value of the field will be determined by the `log_type` and `log_source` values. For example, see link:https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.3/html-single/configuring_logging/index#default-splunk-metadata-key-values_configuring-log-forwarding[Default Splunk metadata key values].
67+
<8> Specify the fields to be added to the Splunk index. This field is optional. The values are stored directly in the index alongside the raw event data, allowing for faster search performance on those fields.
68+
However, `indexed_fields` fields increase storage use. Use them only for high-value fields that provide significant search benefits, for example, large datasets with frequent queries on specific fields.
69+
You can use complex and nested fields as indexed fields. These are automatically transformed to meet Splunk's requirements.
70+
<9> Specify the record field to be used as the payload.
71+
By default, the `payloadKey` field is not set, which means the complete log record is forwarded as the payload.
72+
Use the `payloadKey` field carefully. Selecting a single field as the payload may cause other important information in the log to be dropped, potentially leading to inconsistent or incomplete log events.
6973
<10> Specify the compression configuration, which can be either `gzip` or `none`. The default value is `none`. This field is optional.
7074
<11> Specify the input names.
7175
<12> Specify the name of the output to use when forwarding logs with this pipeline.

0 commit comments

Comments
 (0)