Splunk

To get more details about how to setup the HEC in Splunk please refer to the following documentation: Splunk / Use the HTTP Event Collector

Splunk output plugin supports TTL/SSL, for more details about the properties available and general configuration, please refer to the section.

In order to insert records into a Splunk service, you can run the plugin from the command line or through the configuration file:

Command Line

The splunk plugin, can read the parameters from the command line in two ways, through the -p argument (property), e.g:

  2.     Tag   cpu
  4. [OUTPUT]
  5.     Name        splunk
  6.     Match       *
  7.     Host        127.0.0.1
  8.     Port        8088
  9.     TLS         On
  11.     Message_Key my_key

Data format

By default, the Splunk output plugin nests the record under the event key in the payload sent to the HEC. It will also append the time of the record to a top level time key.

If you would like to customize any of the Splunk event metadata, such as the host or target index, you can set Splunk_Send_Raw On in the plugin configuration, and add the metadata as keys/values in the record. Note: with Splunk_Send_Raw enabled, you are responsible for creating and populating the event section of the payload.

For example, to add a custom index and hostname:

This will create a payload that looks like:

  1. {
  2.     "index": "my-splunk-index",
  4.     "event": {
  5.         "cpu_p":0.000000,
  6.         "user_p":0.000000,
  7.         "system_p":0.000000
  8.     }
  9. }

For more information on the Splunk HEC payload format and all event meatadata Splunk accepts, see here: http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC

If the option splunk_send_raw has been enabled, the user must take care to put all log details in the event field, and only specify fields known to Splunk in the top level event, if there is a mismatch, Splunk will return a HTTP error 400.

splunk_send_raw off

splunk_send_raw on

  1. {"time": .., "k1": "foo", "k2": "bar", "index": "applogs"}

For up to date information about the valid keys in the top level object, refer to the Splunk documentation:

With Splunk version 8.0> you can also use the Fluent Bit Splunk output plugin to send data to metric indices. This allows you to perform visualizations, metric queries, and analysis with other metrics you may be collecting. This is based off of Splunk 8.0 support of multi metric support via single JSON payload, more details can be found on Splunk’s documentation page

Sending to a Splunk Metric index requires the use of Splunk_send_raw option being enabled and formatting the message properly. This includes three specific operations

  • Nest metric events under a “fields” property
  • Add to all metrics

Example Configuration