Documentation Grafana Alloy Reference Components otelcol otelcol.receiver.splunkhec

otelcol.receiver.splunkhec

Public preview: This is a public preview component. Public preview components are subject to breaking changes, and may be replaced with equivalent functionality that cover the same use case. The stability.level flag must be set to public-preview or below to use the component.

otelcol.receiver.splunkhec accepts events in the Splunk HEC format and forwards them to other otelcol.* components. The receiver accepts data formatted as JSON HEC events under any path or as EOL separated log raw data if sent to the raw_path path.

You can specify multiple otelcol.receiver.splunkhec components by giving them different labels.

Usage

alloy Copy

otelcol.receiver.splunkhec "<LABEL>" {
  output {
    metrics = [...]
    logs    = [...]
  }
}

Arguments

You can use the following arguments with otelcol.receiver.splunkhec:

By default, otelcol.receiver.splunkhec listens for HTTP connections on localhost:8088. To expose the HTTP server to other machines on your network, configure endpoint with the IP address to listen on, or 0.0.0.0:8088 to listen on all network interfaces.

If access_token_passthrough is enabled it will be preserved as a attribute com.splunk.hec.access_token. If logs or metrics are exported with otelcol.exporter.splunkhec it will check for this attribute and if present forward it with outgoing request.

Blocks

You can use the following blocks with otelcol.receiver.splunkhec:

tls

The tls block configures TLS settings used for a server. If the tls block isn’t provided, TLS isn’t used for connections to the server.

The following arguments are supported:

If reload_interval is set to "0s", the certificate never reloaded.

The following pairs of arguments are mutually exclusive and can’t both be set simultaneously:

• ca_pem and ca_file
• cert_pem and cert_file
• key_pem and key_file

If cipher_suites is left blank, a safe default list is used. Refer to the Go Cipher Suites documentation for a list of supported cipher suites.

client_ca_file sets the ClientCA and ClientAuth to RequireAndVerifyClientCert in the TLSConfig. Refer to the Go TLS documentation for more information.

The curve_preferences argument determines the set of elliptic curves to prefer during a handshake in preference order. If not provided, a default list is used. The set of elliptic curves available are X25519, P521, P256, and P384.

cors

The cors block configures CORS settings for an HTTP server.

The following arguments are supported:

The allowed_headers specifies which headers are acceptable from a CORS request. The following headers are always implicitly allowed:

• Accept
• Accept-Language
• Content-Type
• Content-Language

If allowed_headers includes "*", all headers are permitted.

hec_metadata_to_otel_attrs

The hec_metadata_to_otel_attrs block configures OpenTelemetry attributes from HEC metadata.

debug_metrics

The debug_metrics block configures the metrics that this component generates to monitor its state.

The following arguments are supported:

disable_high_cardinality_metrics is the Grafana Alloy equivalent to the telemetry.disableHighCardinalityMetrics feature gate in the OpenTelemetry Collector. It removes attributes that could cause high cardinality metrics. For example, attributes with IP addresses and port numbers in metrics about HTTP and gRPC connections are removed.

output

Required

The output block configures a set of components to forward resulting telemetry data to.

The following arguments are supported:

You must specify the output block, but all its arguments are optional. By default, telemetry data is dropped. Configure the metrics and logs arguments accordingly to send telemetry data to other components.

Exported fields

otelcol.receiver.splunkhec doesn’t export any fields.

Component health

otelcol.receiver.splunkhec is only reported as unhealthy if given an invalid configuration.

Debug information

otelcol.receiver.splunkhec doesn’t expose any component-specific debug information.

Example

This example forwards received telemetry through a batch processor before finally sending it to an OTLP-capable endpoint:

alloy Copy

otelcol.receiver.splunkhec "default" {
  output {
    logs    = [otelcol.processor.batch.default.input]
    metrics = [otelcol.processor.batch.default.input]
  }
}

otelcol.processor.batch "default" {
  output {
    metrics = [otelcol.exporter.otlp.default.input]
    traces  = [otelcol.exporter.otlp.default.input]
  }
}

otelcol.exporter.otlp "default" {
  client {
    endpoint = sys.env("<OTLP_ENDPOINT>")
  }
}

Enable authentication

You can create a otelcol.receiver.splunkhec component that requires authentication for requests. This is useful for limiting who can push data to the server.

alloy Copy

otelcol.receiver.splunkhec "default" {
  output {
    logs    = [otelcol.processor.batch.default.input]
    metrics = [otelcol.processor.batch.default.input]
  }
  auth = otelcol.auth.basic.creds.handler
}

otelcol.auth.basic "creds" {
    username = sys.env("<USERNAME>")
    password = sys.env("<PASSWORD>")
}

Compatible components

otelcol.receiver.splunkhec can accept arguments from the following components:

• Components that export OpenTelemetry otelcol.Consumer