Basic Configuration Item | Required | Description | Example |
Shipping Task Name | Required | Name of the shipping task. | Ship to splunk-test123. |
Log Topic | No | Shipped log topic. | Guangzhou/test123. |
Data Format | No | Original log in JSON format. When selecting the JSON format for log shipping, you can choose to either include or exclude the following fields: CLS reserved fields and the __PKGID, __PKGLOGID, and __TAG__ fields used to indicate the log sequence. After configuring the required fields, you can preview the shipped logs below. | - |
Service log | No | Write the monitoring metrics of the shipping task to the free log topic cls_service_log. | Enable the switch. |
Shipping log preview | No | Preview the logs you need to ship. | {"a":123,"b":123,"c":-123,"d":123.45,"e":{"e1":123,"f1":"123"}} |
Target Configuration Item | Required | Description | Example |
Access method | Required | Private network: Splunk is deployed in Tencent Cloud or connected via Direct Connect or CCN. Public network: generally refers to Splunk Cloud Platform, accessed over the public network. | - |
Network service type | Required | When you select the private network, you need to configure the network service type: CLB: The service is forwarded through Cloud Load Balancer (CLB). CVM: The service is deployed directly on Cloud Virtual Machine (CVM) or Tencent Kubernetes Engine (TKE). CCN: The service is connected to Tencent Cloud through CCN. Direct Connect Gateway: The service is connected to Tencent Cloud through Direct Connect Gateway. | - |
Network | Required | When you select the private network, you need to configure the associated network. Select the VPC where your Splunk resides. | - |
Splunk HEC Service Address | Required | 10.0.0.113:8088 | |
HEC Token | Required | 59f9bXXc-ae2f-43c1-8c93-4360XXXX3ef1 | |
Authentication mechanism | No | If you enable SSL authentication in the Splunk HEC configuration, select SSL. | SSL |
Connectivity check | Required | Click the button. The task can be submitted only after the connectivity check is passed. | - |
Target Configuration Item | Required | Description | Example |
Enable Indexer Acknowledgment | No | Splunk processes the next batch of data only after confirming that the data from the HEC has been written to the index. If indexer acknowledgment is enabled in the HEC flag, check the option to enable this feature. | - |
Custom URI | Required | If you use a custom URI in Splunk, enter the URI. | https://splunk-log.example.com:8088/services/collector |
Data Source | Required | Location where logs are generated, such as a directory, network port, or program name. | /var/log/syslog |
Source Type | Required | Log data format/structure, which determines how Splunk parses data. | syslog or json |
Index Name | Required | Write CLS data to the index. | test_index |
Was this page helpful?
You can also Contact sales or Submit a Ticket for help.
Help us improve! Rate your documentation experience in 5 mins.
Feedback