Splunk LogExporter
CertifiedEnterprise EditionSend logs to Splunk HEC
Splunk LogExporter
Send logs to Splunk HEC
Sends log records to a Splunk HTTP Event Collector endpoint using buffered POST requests.
Defaults to chunking 1,000 events per request and sets source to Kestra; requires a HEC token in the Authorization header.
type: io.kestra.plugin.ee.splunk.LogExporterExamples
Ship logs to Splunk
id: log_shipper
namespace: company.team
triggers:
- id: daily
type: io.kestra.plugin.core.trigger.Schedule
cron: "@daily"
tasks:
- id: log_export
type: io.kestra.plugin.ee.core.log.LogShipper
logLevelFilter: INFO
batchSize: 1000
lookbackPeriod: P1D
logExporters:
- id: SplunkLogExporter
type: io.kestra.plugin.ee.splunk.LogExporter
host: YOUR_HOST
token: "{{ secret('SPLUNK_TOKEN') }}"
Properties
host *Requiredstring
Splunk HEC URL
Base URL of the Splunk HTTP Event Collector endpoint (e.g. https://host: 8088); the task appends /services/collector
id *RequiredNon-dynamicstring
^[a-zA-Z0-9][a-zA-Z0-9_-]*1token *Requiredstring
Splunk HEC token
Token sent in the Authorization header to authenticate with Splunk; store it as a secret
chunk integerstring
1000Batch size
Number of log events buffered per POST request; defaults to 1000
options Non-dynamic
HTTP client options
Optional HTTP client configuration such as timeouts, TLS, or proxy settings
io.kestra.core.http.client.configurations.HttpConfiguration
falseIf true, allow a failed response code (response code >= 400)
List of response code allowed for this request
The authentication to use.
io.kestra.core.http.client.configurations.BasicAuthConfiguration
The password for HTTP basic authentication.
The username for HTTP basic authentication.
io.kestra.core.http.client.configurations.BearerAuthConfiguration
The token for bearer token authentication.
io.kestra.core.http.client.configurations.DigestAuthConfiguration
The password for HTTP Digest authentication.
The username for HTTP Digest authentication.
The password for HTTP basic authentication. Deprecated, use auth property with a BasicAuthConfiguration instance instead.
The username for HTTP basic authentication. Deprecated, use auth property with a BasicAuthConfiguration instance instead.
durationThe time allowed to establish a connection to the server before failing.
durationThe time an idle connection can remain in the client's connection pool before being closed.
UTF-8The default charset for the request.
java.nio.charset.Charset
trueWhether to enable TCP Keep-Alive extended socket options (TCP_KEEPIDLE, TCP_KEEPINTERVAL, TCP_KEEPCOUNT).
Set to false when running on Windows workers, as these extended socket options are not supported by the Windows JDK and will cause connection failures.
trueWhether redirects should be followed automatically.
ALLTRACEDEBUGINFOWARNERROROFFNOT_SPECIFIEDThe log level for the HTTP client.
REQUEST_HEADERSREQUEST_BODYRESPONSE_HEADERSRESPONSE_BODYThe enabled log.
The maximum content length of the response.
The proxy configuration.
io.kestra.core.http.client.configurations.ProxyConfiguration
The address of the proxy server.
The password for proxy authentication.
The port of the proxy server.
DIRECTDIRECTHTTPSOCKSThe type of proxy to use.
The username for proxy authentication.
The address of the proxy server.
The password for proxy authentication.
The port of the proxy server.
DIRECTHTTPSOCKSThe type of proxy to use.
The username for proxy authentication.
durationThe time allowed for a read connection to remain idle before closing it.
durationThe maximum time allowed for reading data from the server before failing.
The SSL request options
io.kestra.core.http.client.configurations.SslOptions
Whether to disable checking of the remote SSL certificate.
Only applies if no trust store is configured. Note: This makes the SSL connection insecure and should only be used for testing. If you are using a self-signed certificate, set up a trust store instead.
The timeout configuration.
io.kestra.core.http.client.configurations.TimeoutConfiguration
The time allowed to establish a connection to the server before failing.
PT5MThe time allowed for a read connection to remain idle before closing it.
source string
KestraLog source
Value for the Splunk source field; defaults to Kestra
Metrics
logs counter
Number of logs sent to Splunk
requests.count counter
Number of requests sent to Splunk
requests.duration timer
Duration of the requests sent to Splunk
