apiVersion: observability.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: clf-to-splunk
spec:
  managementState: Managed
  outputs:
  - name: splunk-aosqe
    splunk:
      authentication:
        token:
          key: hecToken
          secretName: to-splunk-secret
      tuning:
        compression: gzip
        delivery: atLeastOnce
        maxWrite: 10000000
      url: https://splunk-default-service.splunk-aosqe.svc:8088
    tls:
      ca:
        key: ca-bundle.crt
        secretName: to-splunk-secret
    type: splunk
  pipelines:
  - inputRefs:
    - application
    name: pipe1
    outputRefs:
    - splunk-aosqe
  serviceAccount:
    name: clf-to-splunk

$oc extract cm/clf-to-splunk-config
#cat vector.toml|grep compression -B 4 -A3
[sinks.output_splunk_aosqe]
type = "splunk_hec_logs"
inputs = ["output_splunk_aosqe_timestamp"]
endpoint = "https://splunk-default-service.splunk-aosqe.svc:8088"
compression = "none"
default_token = "SECRET[kubernetes_secret.to-splunk-secret/hecToken]"
timestamp_key = "@timestamp"