Troubleshooting SplunkHecExporter in opentelemetry-collector-contrib

76 Views Asked by At

I need advice on troubleshooting SplunkHecExporter. I'm using an OpenTelemetry Collector to accept logs via OTLP, export them to an on-prem Splunk Heavy Forwarder, which them forwards them to Splunk Cloud. Below is my configuration. I'm sending some test logs from Postman but the logs don't arrive in Splunk Cloud. I see the arrival of the logs in the OpenTelemetry Collector through the debug exporter. I confirmed connectivity to the Splunk Heavy Forwarder by setting an invalid token which results in an authentication error. Using a valid token doesn't result in any debug logs being recorded. Any suggestions on troubleshooting?

exporters:
  debug:
    verbosity: normal
  splunk_hec:
    token: "<valid token>"
    endpoint: "https://splunkheavyforwarder.mydomain.local:8088/services/collector/event"
    source: "oteltest"
    sourcetype: "oteltest"
    index: "<valid index>"
    tls:
      ca_file: "/etc/otel/config/certs/ca_bundle.cer"
    telemetry:
      enabled: true
    health_check_enabled: true
    heartbeat:
      interval: 10s
service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: []
      exporters: [splunk_hec, debug]
    telemetry:
      logs:
        level: "debug"
0

There are 0 best solutions below