Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-2913

Logforwarding to Splunk


    • Splunk Logforwarding
    • False
    • None
    • False
    • Not Selected
    • NEW
    • To Do
    • Impediment
    • 0% To Do, 0% In Progress, 100% Done


      • Provide a new output option to forward logs to Splunk via splunks HTTP collector.



      Usually, we recommend to use Splunk Connect for Kubernetes but some customers have requirements to send logs to multiple, different systems including Splunk. For these use cases, they'd like to avoid deploying multiple different "Agents" and want to use our supported solution instead.


      For forwarding logs only to Splunk, users should use Splunk Connect for Kubernetes.

      Acceptance Criteria

      • Verify ClusterLogForwarder defines API for forwarding to splunk
      • Verify collector deployments of Vector deliver logs to a spec'd splunk service
      • Verify normalized messages adhere to the viaq data model ??

      Risk and Assumptions

      • Risk Splunk may require alternate normalization; this may be no more challenging then syslog

      Documentation Considerations

      • Update matrix of supported output types with the version against which we tested
      • Updated API reference documentation

      Open Questions

      • How can we test either a functional or integration test?
      • Are there mocking services we can use similar to Cloudwatch
      • What credentials are required to authenticate with the service.

      Additional Notes

            vparfono Vitalii Parfonov
            jcantril@redhat.com Jeffrey Cantrill
            Anping Li Anping Li
            0 Vote for this issue
            12 Start watching this issue