All Apps and Add-ons

Routing logs to different indexes - Splunk Connect for Kubernetes

alanzchan
Path Finder

We just implemented Splunk Connect for Kubernetes on our performance environment. Since the data is coming into via HTTP Event Collector which is only configured to one index, how will we differentiate/route the various application logs to different indexes that are coming into the HEC? I have an idea in mind using props and transforms, but I prefer not doing this because of the performance hit.

Is anyone using Splunk Connect for Kubernetes and if so, how did you set up the configuration so that different application logs go to separate indexes?

0 Karma

fmvangari
New Member

If different apps are in different k8s namespaces, there is a setting in helm config to enable it and choose specific index for default namespace.

0 Karma

nikhils5501
Loves-to-Learn Lots

@fmvangari 

Can you share some info on where I can find this helm config to route logs from a specific namespace to specific index ?

Thanks.

0 Karma

alanzchan
Path Finder

Unfortunately, we are not able to utilize the namespace to index routing feature because all of our applications are in one namespace. Is it a best practice to separate all application to an individual namespace? What if we have hundreds of applications?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...