openshift4-splunk-forwarder

openshift4-splunk-forwarder is a Commodore component to manage openshift4-splunk-forwarder.

See the parameters reference for further details.

Setup

To setup the Splunk forwarder you need to:

Enable the component for the cluster
- If you plan to forward to multiple Splunk servers (multi-tenant) instantiate the component.
Create the following secrets in Vault:
- SSL certificate and private key for the splunk-forwarder
- Splunk Token for the Splunk server
Configure the Splunk server hostname and port.

Example

applications:
  - openshift4-splunk-forwarder as splunk-forwarder-customer-a

parameters:
  splunk_forwarder_customer_a:
    fluentd:
      ssl:
        enabled: true
        cert: |-
          -----BEGIN CERTIFICATE-----
          ...
          -----END CERTIFICATE-----

    splunk:
      hostname: splunk.syn-splunk.svc
      port: 8088