# Splunk Enterprise Receiver

<!-- llms-txt-link: /llms.txt -->

> OpenTelemetry Collector receiver · contrib distribution

The Splunk Enterprise Receiver is a pull based tool which enables the ingestion of performance metrics describing the operational status of a user's Splunk Enterprise deployment to an appropriate observability tool. It is designed to leverage several different data sources to gather these metrics including the [introspection api endpoint](https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/9.1/introspection-endpoints/introspection-endpoint-descriptions) and serializing results from ad-hoc searches. Because of this, care must be taken by users when enabling metrics as running searches can effect your Splunk Enterprise Deployment and introspection may fail to report for Splunk Cloud deployments. The primary purpose of this receiver is to empower those tasked with the maintenance and care of a Splunk Enterprise deployment to leverage opentelemetry and their observability toolset in their jobs.

- **Component ID**: `contrib-splunkenterprisereceiver`
- **Name**: `splunkenterprisereceiver`
- **Type**: receiver
- **Distribution**: contrib
- **Repository**: `opentelemetry-collector-contrib`

## Stability

| Level | Signals |
| --- | --- |
| alpha | metrics |

## Attributes

| Attribute | Type | Description |
| --- | --- | --- |
| `splunk.bucket.dir` | string | The bucket super-directory (home, cold, thawed) for each index |
| `splunk.feature` | string | The Feature name from the Splunk Health Introspection Endpoint |
| `splunk.feature.health` | string | The Health (in color form) of a Splunk Feature from the Splunk Health Introspection Endpoint |
| `splunk.host` | string | The name of the splunk host |
| `splunk.index.name` | string | The name of the index reporting a specific KPI |
| `splunk.indexer.searchable` | string | The searchability status reported for a specific object |
| `splunk.indexer.status` | string | The status message reported for a specific object |
| `splunk.kvstore.external` | string | Value denoting if the KV store is using an external service |
| `splunk.kvstore.status.value` | string | The string value of the status returned when reporting on KV store using the introspection endpoint |
| `splunk.kvstore.storage.engine` | string | The backend storage used by the KV store |
| `splunk.license.label` | string | The label of the license. |
| `splunk.license.status` | string | The status of the license. |
| `splunk.license.type` | string | The type of license. |
| `splunk.queue.name` | string | The name of the queue reporting a specific KPI |
| `splunk.rollingorrestart` | bool | Boolean that indicates if there is a rolling restart or rolling upgrade in progress. |
| `splunk.search.state` | string | The dispatch state of the search |
| `splunk.searchable.restart` | bool | Boolean that indicates if a searchable rolling restart/upgrade in progress.t |
| `splunk.searchartifacts.cache.type` | string | The search artifacts cache type |
| `splunk.splunkd.build` | string | The build number for this Splunk instance version |
| `splunk.splunkd.version` | string | The splunkd version number |

## Data

- **JSON**: [/data/collector/components/contrib-splunkenterprisereceiver/contrib-splunkenterprisereceiver-1d77cb69babf.json](/data/collector/components/contrib-splunkenterprisereceiver/contrib-splunkenterprisereceiver-1d77cb69babf.json)
- **Explore**: [/collector/components/contrib/splunkenterprisereceiver](/collector/components/contrib/splunkenterprisereceiver)