Splunk Enterprise Receiver

OpenTelemetry Collector receiver · contrib distribution

The Splunk Enterprise Receiver is a pull based tool which enables the ingestion of performance metrics describing the operational status of a user's Splunk Enterprise deployment to an appropriate observability tool. It is designed to leverage several different data sources to gather these metrics including the introspection api endpoint and serializing results from ad-hoc searches. Because of this, care must be taken by users when enabling metrics as running searches can effect your Splunk Enterprise Deployment and introspection may fail to report for Splunk Cloud deployments. The primary purpose of this receiver is to empower those tasked with the maintenance and care of a Splunk Enterprise deployment to leverage opentelemetry and their observability toolset in their jobs.

Component ID: contrib-splunkenterprisereceiver
Name: splunkenterprisereceiver
Type: receiver
Distribution: contrib
Repository: opentelemetry-collector-contrib

Stability

Level	Signals
alpha	metrics

Attributes

Attribute	Type	Description
`splunk.bucket.dir`	string	The bucket super-directory (home, cold, thawed) for each index
`splunk.feature`	string	The Feature name from the Splunk Health Introspection Endpoint
`splunk.feature.health`	string	The Health (in color form) of a Splunk Feature from the Splunk Health Introspection Endpoint
`splunk.host`	string	The name of the splunk host
`splunk.index.name`	string	The name of the index reporting a specific KPI
`splunk.indexer.searchable`	string	The searchability status reported for a specific object
`splunk.indexer.status`	string	The status message reported for a specific object
`splunk.kvstore.external`	string	Value denoting if the KV store is using an external service
`splunk.kvstore.status.value`	string	The string value of the status returned when reporting on KV store using the introspection endpoint
`splunk.kvstore.storage.engine`	string	The backend storage used by the KV store
`splunk.license.label`	string	The label of the license.
`splunk.license.status`	string	The status of the license.
`splunk.license.type`	string	The type of license.
`splunk.queue.name`	string	The name of the queue reporting a specific KPI
`splunk.rollingorrestart`	bool	Boolean that indicates if there is a rolling restart or rolling upgrade in progress.
`splunk.search.state`	string	The dispatch state of the search
`splunk.searchable.restart`	bool	Boolean that indicates if a searchable rolling restart/upgrade in progress.t
`splunk.searchartifacts.cache.type`	string	The search artifacts cache type
`splunk.splunkd.build`	string	The build number for this Splunk instance version
`splunk.splunkd.version`	string	The splunkd version number