Skip to content
This repository was archived by the owner on Sep 2, 2025. It is now read-only.
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion gdi/opentelemetry/collector-kubernetes/install-k8s.rst
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ Depending on your destination, you need:
* ``splunkObservability.accessToken``. Your Splunk Observability Cloud org access token with ingest authorization scope. See :ref:`admin-org-tokens`.
* ``splunkObservability.realm``. Splunk realm to send telemetry data to. The default is ``us0``. See :new-page:`realms <https://dev.splunk.com/observability/docs/realms_in_endpoints/>`.

.. note:: The Collector for Kubernetes uses ``main`` as the default Splunk platform index.
.. note:: The Collector for Kubernetes uses ``main`` as the default Splunk platform index. You can use annotations to send data to different indexes. See :ref:`kubernetes-config-logs-annotations-indexes` for more information.

Deploy the Helm chart
==============================================
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@ Collect logs and events for the Collector for Kubernetes
.. meta::
:description: Configure logs and events for the Splunk Distribution of OpenTelemetry Collector for Kubernetes.


.. note:: See how to configure the Collector for Kubernetes at :ref:`otel-kubernetes-config` and :ref:`otel-kubernetes-config-advanced`.

Starting on version 0.86.0, the Splunk Distribution of the Collector for Kubernetes collects native OpenTelemetry logs by default.
Expand Down Expand Up @@ -77,17 +76,26 @@ To process multi-line logs, add the following section to your values.yaml config

Use :new-page:`regex101 <https://regex101.com/ >` to find a Golang regex that works for your format and specify it in the config file for the config option ``firstEntryRegex``.

.. _kubernetes-config-logs-annotations:

Manage log ingestion using annotations
===========================================================================

Use the ``splunk.com/index`` annotation on pods or namespaces to indicate which Splunk platform indexes you want to send logs to. Pod annotation will take precedence over namespace annotation when both are annotated.
.. _kubernetes-config-logs-annotations-indexes:

Send logs to different indexes
-----------------------------------------------------

The Collector for Kubernetes uses ``main`` as the default Splunk platform index. Use the ``splunk.com/index`` annotation on pods or namespaces to indicate which Splunk platform indexes you want to send logs to.

For example, to send logs from the ``kube-system`` namespace to the ``k8s_events`` index, use the command:

.. code-block:: bash

kubectl annotate namespace kube-system splunk.com/index=k8s_events

.. note:: A pod annotation takes precedence over a namespace annotation when both are annotated.

Filter logs using pod or namespace annotations
-----------------------------------------------------

Expand Down
3 changes: 3 additions & 0 deletions logs/processors.rst
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,9 @@ Going forward after the transition to Log Observer Connect, you can process data
* - Data Stream Processor
- See :new-page:`Use the Data Stream Processor <https://docs.splunk.com/Documentation/DSP/1.4.2/User/About>`.

* - Ingest Processor
- See :new-page:`About Ingest Processor <https://docs.splunk.com/Documentation/SplunkCloud/latest/IngestProcessor/AboutIngestProcessorSolution>`.


Prepackaged processing rules
=============================================================================
Expand Down