Splunk output plugin allows to ingest your records into a Splunk Enterprise service through the HTTP Event Collector (HEC) interface.
To get more details about how to setup the HEC in Splunk please refer to the following documentation: Splunk / Use the HTTP Event Collector
IP address or hostname of the target Splunk service.
TCP port of the target Splunk service.
When enabled, the record keys and values are set in the top level of the map instead of under the event key.
Optional username for Basic Authentication on HEC
Password for user defined in HTTP_User
Splunk output plugin supports TTL/SSL, for more details about the properties available and general configuration, please refer to the TLS/SSL section.
In order to insert records into a Splunk service, you can run the plugin from the command line or through the configuration file:
The splunk plugin, can read the parameters from the command line in two ways, through the -p argument (property), e.g:
$ fluent-bit -i cpu -t cpu -o splunk -p host=127.0.0.1 -p port=8088 \
-p tls=on -p tls.verify=off -m '*'
In your main configuration file append the following Input & Output sections:
By default, the Splunk output plugin nests the record under the
eventkey in the payload sent to the HEC. It will also append the time of the record to a top level
If you would like to customize any of the Splunk event metadata, such as the host or target index, you can set
Splunk_Send_Raw Onin the plugin configuration, and add the metadata as keys/values in the record. Note: with
Splunk_Send_Rawenabled, you are responsible for creating and populating the
eventsection of the payload.
For example, to add a custom index and hostname:
# nest the record under the 'event' key
# add event metadata
Add index my-splunk-index
Add host my-host
This will create a payload that looks like:
For more information on the Splunk HEC payload format and all event meatadata Splunk accepts, see here: http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC