Note: The Splunk Connect for Kubernetes will reach End of Support on January 1, 2024. After that date, this project will no longer receive updates from Splunk and will no longer be supported by Splunk. Until then, only critical security fixes and bug fixes will be provided. Splunk recommends migrating to Splunk OpenTelemetry Collector for Kubernetes. Please refer to this guide for more details.

What does Splunk Connect for Kubernetes do?

Splunk Connect for Kubernetes provides a way to import and search your Kubernetes logging, object, and metrics data in Splunk. Now, Splunk Connect for Kubenetes also supports importing and searching your container logs on AWS ECS and AWS Fargate using firelens. Splunk is a proud contributor to Cloud Native Computing Foundation (CNCF) and Splunk Connect for Kubernetes utilizes and supports multiple CNCF components in the development of these tools to get data into Splunk.

Prerequisites

• Splunk Enterprise 7.0 or later
• An HEC token. See the following topics for more information:
• http://docs.splunk.com/Documentation/Splunk/7.2.4/Data/UsetheHTTPEventCollector
• http://docs.splunk.com/Documentation/Splunk/7.2.4/Data/ScaleHTTPEventCollector
• You should be familiar with your Kubernetes configuration and know where your log info is collected in Kubernetes.
• You must have administrator access to your Kubernetes cluster.
• To install using Helm (recommended), make sure you are running Helm in your Kubernetes configuration. See https://github.com/kubernetes/helm
• Have a minimum of two Splunk indexes ready to collect the log data, one for both logs and Kubernetes objects, and one for metrics. You can also create separate indexes for logs and objects, in which case you will need three Splunk indexes.

For installation and configuration instructions, see the Splunk Connect for Kubernetes documentation on github.

Splunk Connect For Kubernetes is supported through Splunk Support assuming the customer has a current Splunk support entitlement. For customers that do not have a current Splunk support entitlement, please file an issue at create a new issue at Create a new issue in splunk connect for kubernetes project The current maintainers of this project are the DataEdge team at Splunk. You can reach us at DataEdge@splunk.com.