Configuring Splunk log collection

Splunk Log Collection is a logging integration that allows the Virtana Platform to forward application logs, traces, and metadata to an external Splunk instance. When enabled, logs generated by both the frontend and backend services are streamed to your Splunk environment, enabling centralized log management.

Enabling Splunk Log Collection aggregates logs from all Virtana Platform services into a single Splunk instance for unified visibility. It quickly searches and correlates logs across pods, namespaces, and containers to diagnose issues. It leads to setting up Splunk alerts and dashboards based on real-time log data from your clusters.

By default, the platform does not send logs to Splunk. You need to configure this if your organization uses Splunk as its log management solution and wants to integrate Virtana Platform logs into it.

To enable Splunk Log Collection, set the log_source parameter to splunk in your Helm chart values files and configure the required parameters below. Configuration is split across two files:

Frontend values.yaml: Contains connection details, headers, labels, SSL, and trace settings.
Backend values.yaml: Contains the cluster name and Splunk index definitions.

Configuration values file

global:
  log_config:
    log_source: splunk
     splunk_external_url: ""
     splunk_custom_headers: ""
     splunk_params: ""
     splunk_label_configs:
       cluster_name: "cluster_name"
       pod: "pod"
       namespace: "namespace"
       node: "node"
       container_name: "container_name"
       spanID: ""
       traceID: ""
     splunk_enable_ssl_context: false
     splunk_auth_token: ""
     splunk_trace_params: ""

    splunk_cluster_name: ""
    splunk_indexes:
    #   - main
    #   - prod

The following table describes each field in the configuration file.

Table 99.

Field	Description	Default value
General parameter
`log_source`	The logging backend to use. When set to `splunk`, all other Splunk-related parameters below become applicable.	`splunk`
Frontend parameters
`splunk_external_url`	The URL of your external Splunk HTTP Event Collector (HEC) endpoint.	`""`
`splunk_custom_headers`	Comma-separated custom HTTP headers to include in requests to Splunk.	`""`
`splunk_params`	Additional query parameters appended to Splunk log requests.	`""`
`splunk_label_configs`	A mapping of Kubernetes metadata labels to include with each log entry sent to Splunk.
`cluster_name`	Label key for the Kubernetes cluster name.	`cluster_name`
`pod`	Label key for the pod name that generated the log.	`pod`
`namespace`	Label key for the Kubernetes namespace.	`namespace`
`node`	Label key for the Kubernetes node where the pod is running.	`node`
`container_name`	Label key for the container name within the pod.	`container_name`
`spanID`	Label key for the distributed trace span ID.	`""`
`traceID`	Label key for the distributed trace ID.	`""`
`splunk_enable_ssl_context`	Set to `true` to enable SSL/TLS verification when connecting to the Splunk endpoint.	`false`
`splunk_auth_token`	The authentication token for the Splunk HEC endpoint.	`""`
`splunk_trace_params`	Filter parameters for trace data sent to Splunk.	`""`
Backend parameters
`splunk_cluster_name`	The name of the Kubernetes cluster as it should appear in Splunk.	""
`splunk_indexes`	A list of Splunk index names where logs should be stored.	[]

Getting started

Perform the following steps:

Obtain a Splunk HEC token and endpoint URL from your Splunk administrator.
Set log_source: splunk under global.log_config.
In your frontend values.yaml, provide splunk_external_url and splunk_auth_token at minimum.
In your backend values.yaml, set splunk_cluster_name and optionally define splunk_indexes.
Deploy or upgrade your Helm release with the updated values files.
Verify logs are arriving in Splunk by searching for entries tagged with your cluster name.

In this section:

Configuring Splunk log collection

Configuration values file

Getting started

Search results