Skip to content

Commit 6d7f025

Browse files
esmerelcnorris-cs
andauthored
Apply suggestions from code review
Co-authored-by: Craig Norris <[email protected]> Signed-off-by: Lynette Miles <[email protected]>
1 parent 584c14b commit 6d7f025

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

pipeline/outputs/splunk.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ This will create a payload that looks like:
189189

190190
### Sending raw events
191191

192-
If the option `splunk_send_raw` has been enabled, the user must add all log details in the event field, and only specify fields known to Splunk in the top level event. If there is a mismatch, Splunk returns an HTTP error `400`.
192+
If the option `splunk_send_raw` has been enabled, the user must add all log details in the event field, and only specify fields known to Splunk in the top level event. If there is a mismatch, Splunk returns an HTTP `400 Bad Request` status code.
193193

194194
Consider the following examples:
195195

@@ -211,7 +211,7 @@ For up-to-date information about the valid keys, see [Getting Data In](https://d
211211

212212
With Splunk version 8.0 and later, you can use the Fluent Bit Splunk output plugin to send data to metric indices. This lets you perform visualizations, metric queries, and analysis with other metrics you might be collecting. This is based off of Splunk 8.0 support of multi metric support using single JSON payload, more details can be found in [Splunk metrics documentation](https://docs.splunk.com/Documentation/Splunk/9.4.2/Metrics/GetMetricsInOther#The_multiple-metric_JSON_format)
213213

214-
Sending to a Splunk metric index requires the use of `Splunk_send_raw` option being enabled and formatting the message properly. This includes three specific operations
214+
Sending to a Splunk metric index requires the use of `Splunk_send_raw` option being enabled and formatting the message properly. This includes these specific operations:
215215

216216
- Nest metric events under a `fields` property
217217
- Add `metric_name:` to all metrics
@@ -303,9 +303,7 @@ pipeline:
303303

304304
## Send metrics events of Fluent Bit
305305

306-
In Fluent Bit 2.0 or later, you can also send Fluent Bit metrics the `events` type into Splunk using Splunk HEC.
307-
This lets you perform visualizations, metric queries, and analysis with directly sent using Fluent Bit metrics.
308-
This is based off Splunk 8.0 support of multi metric support using a single concatenated JSON payload.
306+
In Fluent Bit 2.0 or later, you can send Fluent Bit metrics the `events` type into Splunk using Splunk HEC. This lets you perform visualizations, metric queries, and analysis with directly sent using Fluent Bit metrics. This is based off Splunk 8.0 support of multi metric support using a single concatenated JSON payload.
309307

310308
Sending Fluent Bit metrics into Splunk requires the use of collecting Fluent Bit metrics plugins, whether events type of logs or metrics can be distinguished automatically.
311309
You don't need to pay attentions about the type of events.

0 commit comments

Comments
 (0)