You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* `SPLUNK_INDEX`: The Splunk index events will be sent to. Warning: Setting an invalid index will cause events to be lost. This index must match one of the selected indexes for the Splunk HTTP event collector token used for the SPLUNK_TOKEN parameter.
64
+
65
+
__Advanced Configuration Features:__
66
+
* `JOB_NAME`: Tags nozzle log events with job name.
67
+
* `JOB_INDEX`: Tags nozzle log events with job index.
68
+
* `JOB_HOST`: Tags nozzle log events with job host.
69
+
* `SKIP_SSL_VALIDATION_CF`: Skips SSL certificate validation for connection to Cloud Foundry. Secure communications will not check SSL certificates against a trusted certificate authority.
70
+
This is recommended for dev environments only.
71
+
* `SKIP_SSL_VALIDATION_SPLUNK`: Skips SSL certificate validation for connection to Splunk. Secure communications will not check SSL certificates against a trusted certificate authority.
72
+
This is recommended for dev environments only.
73
+
* `FIREHOSE_SUBSCRIPTION_ID`: Tags nozzle events with a Firehose subscription id. See https://docs.pivotal.io/pivotalcf/1-11/loggregator/log-ops-guide.html.
74
+
* `FIREHOSE_KEEP_ALIVE`: Keep alive duration for the Firehose consumer.
75
+
* `ADD_APP_INFO`: Enriches raw data with app details.
76
+
* `IGNORE_MISSING_APP`: If the application is missing, then stop repeatedly querying application info from Cloud Foundry.
77
+
* `MISSING_APP_CACHE_INVALIDATE_TTL`: How frequently the missing app info cache invalidates.
78
+
* `APP_CACHE_INVALIDATE_TTL`: How frequently the app info local cache invalidates.
79
+
* `APP_LIMITS`: Restrict to APP_LIMITS the most updated apps per request when populating the app metadata cache.
80
+
* `BOLTDB_PATH`: Bolt database path.
81
+
* `EVENTS`: A comma separated list of events to include. Possible values: ValueMetric,CounterEvent,Error,LogMessage,HttpStartStop,ContainerMetric
82
+
* `EXTRA_FIELDS`: Extra fields to annotate your events with (format is key:value,key:value).
83
+
* `FLUSH_INTERVAL`: Time interval for flushing queue to Splunk regardless of CONSUMER_QUEUE_SIZE. Protects against stale events in low throughput systems.
84
+
* `CONSUMER_QUEUE_SIZE`: Sets the internal consumer queue buffer size. Events will be pushed to Splunk after queue is full.
85
+
* `HEC_BATCH_SIZE`: Set the batch size for the events to push to HEC (Splunk HTTP Event Collector).
86
+
* `HEC_RETRIES`: Retry count for sending events to Splunk. After expiring, events will begin dropping causing data loss.
87
+
* `HEC_WORKERS`: Set the amount of Splunk HEC workers to increase concurrency while ingesting in Splunk.
88
+
* `SPLUNK_VERSION`: The Splunk version that determines how HEC ingests metadata fields. For example: 6.6.
89
+
* `ENABLE_EVENT_TRACING`: Enables event trace logging. Splunk events will now contain a UUID, Splunk Nozzle Event Counts, and a Subscription-ID for Splunk correlation searches.
description: Forward firehose logs & metrics to Splunk
5
+
icon_file: icon.png
6
+
7
+
apply_open_security_group: true # Apply open security group, default: false
8
+
allow_paid_service_plans: true # Allow paid service plans, default: false
9
+
10
+
stemcell_criteria:
11
+
os: ubuntu-trusty
12
+
requires_cpi: false
13
+
version: '3421'
14
+
15
+
properties:
16
+
- name: author
17
+
type: string
18
+
label: Author
19
+
value: Shubham Jain
20
+
21
+
forms:
22
+
- name: splunk-config
23
+
label: Splunk Settings
24
+
description: Splunk HTTP Event Collector Settings
25
+
markdown: |
26
+
Configure your Splunk HTTP Event Collector. See http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector
27
+
properties:
28
+
- name: splunk_host
29
+
type: string
30
+
label: HTTP Event Collector Endpoint URL
31
+
description: HTTP Event Collector endpoint URL.
32
+
- name: splunk_token
33
+
type: secret
34
+
label: HTTP Event Collector Token
35
+
description: Splunk HTTP Event Collector token.
36
+
- name: skip_ssl_validation_splunk
37
+
type: boolean
38
+
label: Skip SSL Validation
39
+
default: false
40
+
description: Skip SSL certificate validation for connection to Splunk. Secure communications will not check SSL certificates against a trusted Certificate Authority. Skipping SSL validation in production environment is not recommended.
41
+
- name: splunk_index
42
+
type: string
43
+
label: Index
44
+
description: The name of the Splunk index that events will be sent to. WARNING:Setting an invalid index will cause events to be lost.
45
+
default: main
46
+
47
+
- name: cf-config
48
+
label: Cloud Foundry Settings
49
+
description: Cloud Foundry Connection Settings
50
+
properties:
51
+
- name: api_endpoint
52
+
type: string
53
+
label: API Endpoint
54
+
description: Cloud Foundry API endpoint.
55
+
- name: api_user
56
+
type: string
57
+
label: API User
58
+
description: API username
59
+
- name: api_password
60
+
type: secret
61
+
label: API Password
62
+
description: Password for API user
63
+
- name: skip_ssl_validation_cf
64
+
type: boolean
65
+
label: Skip SSL Validation
66
+
default: false
67
+
description: Skip SSL certificate validation for connection to Cloud Foundry. Secure communications will not check SSL certificates against a trusted Certificate Authority. Skipping SSL validation in production environment is not recommended.
description: Scale out Splunk nozzle. Recommendation:Run 2 or more nozzles for high availability.
96
+
default: 2
97
+
- name: firehose_subscription_id
98
+
type: string
99
+
label: Firehose Subscription ID
100
+
description: Unique subscription ID to nozzle. Firehose balances across socket connections with the same ID.
101
+
optional: true
102
+
- name: extra_fields
103
+
type: string
104
+
label: Additional Fields
105
+
description: A set of user defined key:value pairs that are added to all Splunk events that do not occur in the event payload. Expected format - key1:value1, key2:value2, key3:value3
106
+
optional: true
107
+
- name: add_app_info
108
+
type: boolean
109
+
default: false
110
+
label: Add App Information
111
+
description: Enriches raw data with application metadata, such as application name, space name, org name, etc.
112
+
- name: enable_event_tracing
113
+
type: boolean
114
+
label: Enable Event Tracing
115
+
default: false
116
+
description: Enables data loss tracing.
117
+
118
+
119
+
packages:
120
+
- name: splunk-firehose-nozzle
121
+
type: app
122
+
label: Splunk-Firehose-Nozzle
123
+
manifest:
124
+
memory: 256M
125
+
instances: MY_INSTANCE_COUNT
126
+
buildpack: binary_buildpack
127
+
health-check-type: process
128
+
no-route: true
129
+
path: ../splunk-firehose-nozzle
130
+
command: ./splunk-firehose-nozzle
131
+
env:
132
+
GOPACKAGENAME: main
133
+
pre_deploy: |
134
+
sed -i "s/MY_INSTANCE_COUNT/$SCALE_OUT_NOZZLE/g" $PACKAGE_PATH/splunk_firehose_nozzle/manifest.yml
0 commit comments