You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Sep 2, 2025. It is now read-only.
Copy file name to clipboardExpand all lines: gdi/get-data-in/connect/aws/aws-prereqs.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -412,7 +412,7 @@ Read more at the official AWS documentation:
412
412
413
413
* :new-page:`AWS Organization Service Control Policies <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>`
414
414
* :new-page:`Permissions boundaries for IAM entities <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html>`
415
-
* :new-page:`Troubleshooting IAM permission access denied or unauthorized errors <https://web.archive.org/web/20231129090004/https://repost.aws/knowledge-center/troubleshoot-iam-permission-errors>`
415
+
* :new-page:`Troubleshooting IAM permission access denied or unauthorized errors <https://repost.aws/knowledge-center/troubleshoot-iam-permission-errors>`
Copy file name to clipboardExpand all lines: gdi/get-data-in/connect/aws/aws-troubleshooting.rst
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,22 +18,22 @@ If issues persist, you can also contact :ref:`support`.
18
18
Error validating your AWS connection
19
19
=========================================
20
20
21
-
The automatic attempt to validate a connection that you just configured fails, so there is no connection between Splunk Observability Cloud and your AWS account.
21
+
The automatic attempt to validate a connection that you just configured fails, so there is no connection between Splunk Observability Cloud and your AWS account. This can include failed API calls with ``400`` error codes.
22
22
23
23
Cause
24
24
^^^^^^
25
25
26
-
The connection might fail due to invalid Identity Access Management (IAM) policy used by your AWS integration.
26
+
The connection might fail due to your AWS integration using invalid Identity Access Management (IAM) policies, or missing some of the required permissions.
27
27
28
-
If you use the AWS Organizations' :new-page:`Service control policies <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>` or :new-page:`Permission boundaries for IAM entities <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html>`, they
28
+
If you use AWS Organizations' :new-page:`Service control policies <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>` or :new-page:`Permission boundaries for IAM entities <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html>`, they
29
29
might impact the AWS IAM policy you're using to connect to Splunk Observability Cloud.
30
30
31
31
Solution
32
32
^^^^^^^^^
33
33
34
-
Ensure all :ref:`aws-required-permissions` are included in your IAM policy.
34
+
Make sure to include all the required policies to connect your AWS account to Splunk Observability Cloud, as described in :ref:`aws-required-permissions`. Note that required permissions depend on your connection method (polling or Metric Streams), and that tag collection requires specific permissions.
35
35
36
-
Also review the AWS Organizations' policies and boundaries you're using.
36
+
You also need to review the AWS Organizations' policies and boundaries you're using.
Copy file name to clipboardExpand all lines: gdi/opentelemetry/collector-kubernetes/install-k8s.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -72,7 +72,7 @@ Depending on your destination, you need:
72
72
* ``splunkObservability.accessToken``. Your Splunk Observability Cloud org access token with ingest authorization scope. See :ref:`admin-org-tokens`.
73
73
* ``splunkObservability.realm``. Splunk realm to send telemetry data to. The default is ``us0``. See :new-page:`realms <https://dev.splunk.com/observability/docs/realms_in_endpoints/>`.
74
74
75
-
.. note:: The Collector for Kubernetes uses ``main`` as the default Splunk platform index.
75
+
.. note:: The Collector for Kubernetes uses ``main`` as the default Splunk platform index. You can use annotations to send data to different indexes. See :ref:`kubernetes-config-logs-annotations-indexes` for more information.
:description: Configure logs and events for the Splunk Distribution of OpenTelemetry Collector for Kubernetes.
10
10
11
-
12
11
.. note:: See how to configure the Collector for Kubernetes at :ref:`otel-kubernetes-config` and :ref:`otel-kubernetes-config-advanced`.
13
12
14
13
Starting on version 0.86.0, the Splunk Distribution of the Collector for Kubernetes collects native OpenTelemetry logs by default.
@@ -77,17 +76,26 @@ To process multi-line logs, add the following section to your values.yaml config
77
76
78
77
Use :new-page:`regex101 <https://regex101.com/ >` to find a Golang regex that works for your format and specify it in the config file for the config option ``firstEntryRegex``.
Use the ``splunk.com/index`` annotation on pods or namespaces to indicate which Splunk platform indexes you want to send logs to. Pod annotation will take precedence over namespace annotation when both are annotated.
The Collector for Kubernetes uses ``main`` as the default Splunk platform index. Use the ``splunk.com/index`` annotation on pods or namespaces to indicate which Splunk platform indexes you want to send logs to.
84
90
85
91
For example, to send logs from the ``kube-system`` namespace to the ``k8s_events`` index, use the command:
Use the Universal Forwarder to send logs to the Splunk platform. See more at :ref:`collector-with-the-uf`.
114
-
115
-
Fluentd is turned off by default. If you already installed Fluentd on a host, re-install the Collector without Fluentd using the ``--without-fluentd`` option.
116
-
117
-
.. _fluentd-manual-config-linux:
118
-
119
-
Collect Linux logs with Fluentd
120
-
---------------------------------------
121
-
122
-
If you have a Log Observer entitlement or want to collect logs for the target host with Fluentd, use the ``--with-fluentd`` option to also install Fluentd when installing the Collector. For example:
sudo sh /tmp/splunk-otel-collector.sh --with-fluentd --realm $SPLUNK_REALM -- $SPLUNK_ACCESS_TOKEN
128
-
129
-
When turned on, the Fluentd service is configured by default to collect and forward log events with the ``@SPLUNK`` label to the Collector, which then sends these events to the HEC ingest endpoint determined by the ``--realm <SPLUNK_REALM>`` option. For example, ``https://ingest.<SPLUNK_REALM>.signalfx.com/v1/log``.
130
-
131
-
The following Fluentd plugins are also installed:
132
-
133
-
* ``capng_c`` for activating Linux capabilities.
134
-
* ``fluent-plugin-systemd`` for systemd journal log collection.
135
-
136
-
Additionally, the following dependencies are installed as prerequisites for the Fluentd plugins:
137
-
138
-
.. tabs::
139
-
140
-
.. tab:: Debian-based systems
141
-
142
-
* build-essential
143
-
* libcap-ng0
144
-
* libcap-ng-dev
145
-
* pkg-config
146
-
147
-
.. tab:: RPM-based systems
148
-
149
-
* Development Tools
150
-
* libcap-ng
151
-
* libcap-ng-devel
152
-
* pkgconfig
153
-
154
-
You can specify the following parameters to configure the package to send log events to a custom Splunk HTTP Event Collector (HEC) endpoint URL:
155
-
156
-
* ``--hec-url <URL>``
157
-
* ``--hec-token <TOKEN>``
158
-
159
-
HEC lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP (HTTPS) protocols. See :new-page:`Set up and use HTTP Event Collector in Splunk Web <https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/UsetheHTTPEventCollector>`.
160
-
161
-
The main Fluentd configuration is installed to ``/etc/otel/collector/fluentd/fluent.conf``. Custom Fluentd source configuration files can be added to the ``/etc/otel/collector/fluentd/conf.d`` directory after installation.
162
-
163
-
Note the following:
164
-
165
-
* In this directory, all files with the .conf extension are automatically included by Fluentd.
166
-
* The td-agent user must have permissions to access the configuration files and the paths defined within.
167
-
* By default, Fluentd is configured to collect systemd journal log events from ``/var/log/journal``.
168
-
169
-
After any configuration modification, run ``sudo systemctl restart td-agent`` to restart the td-agent service.
170
-
171
-
If the td-agent package is upgraded after initial installation, you might need to set the Linux capabilities for the new version by performing the following steps for td-agent versions 4.1 or higher:
:description: Describes how to collect logs for the Splunk Distribution of OpenTelemetry Collector for Linux.
11
+
12
+
Use the Universal Forwarder to send logs to the Splunk platform. See more at :ref:`collector-with-the-uf`.
13
+
14
+
Fluentd is turned off by default. If you already installed Fluentd on a host, re-install the Collector without Fluentd using the ``--without-fluentd`` option.
If you have a Log Observer entitlement or want to collect logs for the target host with Fluentd, use the ``--with-fluentd`` option to also install Fluentd when installing the Collector. For example:
sudo sh /tmp/splunk-otel-collector.sh --with-fluentd --realm $SPLUNK_REALM -- $SPLUNK_ACCESS_TOKEN
27
+
28
+
When turned on, the Fluentd service is configured by default to collect and forward log events with the ``@SPLUNK`` label to the Collector, which then sends these events to the HEC ingest endpoint determined by the ``--realm <SPLUNK_REALM>`` option. For example, ``https://ingest.<SPLUNK_REALM>.signalfx.com/v1/log``.
29
+
30
+
The following Fluentd plugins are also installed:
31
+
32
+
* ``capng_c`` for activating Linux capabilities.
33
+
* ``fluent-plugin-systemd`` for systemd journal log collection.
34
+
35
+
Additionally, the following dependencies are installed as prerequisites for the Fluentd plugins:
36
+
37
+
.. tabs::
38
+
39
+
.. tab:: Debian-based systems
40
+
41
+
* build-essential
42
+
* libcap-ng0
43
+
* libcap-ng-dev
44
+
* pkg-config
45
+
46
+
.. tab:: RPM-based systems
47
+
48
+
* Development Tools
49
+
* libcap-ng
50
+
* libcap-ng-devel
51
+
* pkgconfig
52
+
53
+
You can specify the following parameters to configure the package to send log events to a custom Splunk HTTP Event Collector (HEC) endpoint URL:
54
+
55
+
* ``--hec-url <URL>``
56
+
* ``--hec-token <TOKEN>``
57
+
58
+
HEC lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP (HTTPS) protocols. See :new-page:`Set up and use HTTP Event Collector in Splunk Web <https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/UsetheHTTPEventCollector>`.
59
+
60
+
The main Fluentd configuration is installed to ``/etc/otel/collector/fluentd/fluent.conf``. Custom Fluentd source configuration files can be added to the ``/etc/otel/collector/fluentd/conf.d`` directory after installation.
61
+
62
+
Note the following:
63
+
64
+
* In this directory, all files with the .conf extension are automatically included by Fluentd.
65
+
* The td-agent user must have permissions to access the configuration files and the paths defined within.
66
+
* By default, Fluentd is configured to collect systemd journal log events from ``/var/log/journal``.
67
+
68
+
After any configuration modification, run ``sudo systemctl restart td-agent`` to restart the td-agent service.
69
+
70
+
If the td-agent package is upgraded after initial installation, you might need to set the Linux capabilities for the new version by performing the following steps for td-agent versions 4.1 or higher:
0 commit comments