TELEMETRY PIPELINE
Splunk

Splunk destination plugin

The Splunk destination plugin lets you configure Chronosphere Telemetry Pipeline to send your telemetry data to Splunk.

Supported telemetry types

This plugin supports these telemetry types:

LogsMetricsTraces

Configuration parameters

Use the parameters in this section to configure your plugin. The Telemetry Pipeline web interface uses the values in the Name column to describe the parameters. Items in the Key column are the YAML keys to use in pipeline configuration files.

General

NameKeyDescriptionDefault
HosthostRequired. IP address or hostname of the target Splunk service.127.0.0.1
PortportRequired. TCP port of the target Splunk service.8088
CompresscompressSet payload compression mechanism. Accepted values: gzip, none.none
Splunk HTTP Tokensplunk_tokenRequired. Specify the authentication token for the HTTP Event Collector interface.none

Security and TLS

NameKeyDescriptionDefault
TLStlsEnable or disable TLS/SSL support. Accepted values: true, false.false
TLS Certificate Validationtls.verifyEnable or disable TLS/SSL certificate validation. TLS must be enabled for certificates to be validated. Accepted values: off, on.on
TLS Debug Leveltls.debugSet TLS debug verbosity level. Accepted values: 0 (No debug), 1 (Error), 2 (State change), 3 (Informational), 4 (Verbose).1
CA Certificate File Pathtls.ca_fileAbsolute path to CA certificate file.none
Certificate File Pathtls.crt_fileAbsolute path to certificate file.none
Private Key File Pathtls.key_fileAbsolute path to private key file.none
Private Key Path Passwordtls.key_passwdPassword for private key file.none
TLS SNI Hostname Extensiontls.vhostHostname to be used for TLS SNI extension.none

Advanced

NameKeyDescriptionDefault
Enable Splunk Send Rawsplunk_send_rawWhen enabled, the record keys and values are set in the top level of the map instead of under the event key. Refer to the Sending Raw Events section from the docs for more details to make this option work properly. Accepted values: true, false.false
Event Keyevent_keySpecify the key name that will be used to send a single value as part of the record.none
Event Hostevent_hostSet the host value to the event data. The value allows a record accessor pattern.none
Event Sourceevent_sourceSet the source value to assign to the event data.none
Event Source Typeevent_sourcetypeSet the sourcetype value to assign to the event data.none
Event Source Type Keyevent_sourcetype_keySet a record key that will populate sourcetype. If the key is found, it will have precedence over the value set in event_sourcetype.none
Event Indexevent_indexThe name of the index by which the event data is to be indexed.none
Event Index Keyevent_index_keySet a record key that will populate the index field. If the key is found, it will have precedence over the value set in event_index.none
Event Field(s)event_fieldSet event fields for the record. This option can be set multiple times and the format is key_name record_accessor_pattern.none
ProxyproxySpecify an HTTP Proxy. The expected format of this value is http://host:port. HTTPS is not supported.none

Advanced Networking

NameKeyDescriptionDefault
DNS Modenet.dns.modeSelect the primary DNS connection type, which can be TCP or UDP.none
DNS Resolvernet.dns.resolverSelect the primary DNS connection type, which can be LEGACY or ASYNC.none
Prefer IPv4net.dns.prefer_ipv4Prioritize IPv4 DNS results when trying to establish a connection. Accepted values: true, false.false
Keepalivenet.keepaliveEnable or disable Keepalive support. Accepted values: true, false.true
Keepalive Idle Timeoutnet.keepalive_idle_timeoutSet maximum time allowed for an idle Keepalive connection.30s
Max Connect Timeoutnet.connect_timeoutSet maximum time allowed to establish a connection, which includes the TLS handshake.10s
Max Connect Timeout Log Errornet.connect_timeout_log_errorOn connection timeout, specify if it should log an error. When disabled, the timeout is logged as a debug message. Accepted values: true, false.true
Max Keepalive Recyclenet.keepalive_max_recycleSet maximum number of times a keepalive connection can be used before it's retired.2000
Source Addressnet.source_addressSpecify network address to bind for data traffic.none

Basic Authentication

NameKeyDescriptionDefault
HTTP Usernamehttp_userBasic auth username.none
HTTP Passwordhttp_passwdBasic auth password. Requires http_user to be set.none

Debugging

NameKeyDescriptionDefault
HTTP Buffer Sizehttp_buffer_sizeSpecify the buffer size used to read the response from the Splunk HTTP service. This option is used for debugging purposes when it's required to read full responses. Response size grows depending of the number of records inserted. To set an unlimited amount of memory, set this value to false. Otherwise the value must be according to the Unit Size specification.none
Enable HTTP Debug Bad Requesthttp_debug_bad_requestIf the server returns an HTTP 400 Bad Request status code and this flag is enabled, it will print the full HTTP request and response to the stdout interface. Used for debugging purposes. Accepted values: true, false.false