Send logs to Splunk
Create a stream that sends application logs to a Splunk HTTP Event Collector, in Azion Console or with the Azion API, and confirm the delivery.
You can send the logs of a stream to Splunk from Azion Console or with the Azion API.
Data Stream sends each batch of log lines to the HTTP Event Collector (HEC) of your Splunk instance and authenticates with a HEC token. In the stream form, the endpoint is set in the field labeled Connector, and Splunk is its Splunk option. For every field and its bounds, refer to Endpoints.
The example collects the requests of one workload with the Applications data source.
Prerequisites
Console
- An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
- A workload on the account that receives requests.
- A Splunk account.
- An HTTP Event Collector set up for the type of your Splunk instance, and its URL. The URL format depends on the instance type: self-hosted or Splunk Cloud. For the formats, refer to Endpoints.
- A HEC token. The token must be enabled in Splunk.
- Access to Azion Console. To sign in, refer to How to access Azion Console.
Create the stream
The stream collects from the workload you choose, through a workload filter. A workload filter, unlike sampling, does not deactivate your other streams.
Console
To create the stream in Azion Console:
Access Azion Console > Data Stream.
In the General section, enter a Name. For example: logs-to-splunk.
In the Input section, select Applications in Data Source.
In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.
In the Transform section, set Option to Filter Workloads. In Available Workload, select your workload and move it to Chosen Workload with the arrow. If your Console names domains where this guide names workloads, the same control reads Filter Domains. The pick list then reads Available Domain and Chosen Domain.
In the Render Template section, select Applications Event Collector in Template.
In the Output section, select Splunk in Connector.
In URL, enter the HEC URL of your Splunk instance. For example: https://splunk.example.com:8088/services/collector. To send to another index, add the index at the end of the URL, such as ?index=myindex.
In API Key, enter the HEC token of your Splunk instance.
In the Status section, keep Active turned on.
The Console shows Your data stream has been created. The stream appears in the Data Stream list with Splunk in the Connector column and the Active status.
The API and the Console save the stream without contacting Splunk. A wrong URL or HEC token surfaces only when the stream sends. An activation takes effect after one to two minutes.
Confirm the delivery
Real-Time Events records every send of a stream, delivered or not, with the status code the endpoint returned. Send a few requests to the workload, then wait about a minute: a stream sends a batch every 60 seconds, or sooner when it reaches 2,000 log lines.
Console
To find the sends in Azion Console:
Access Azion Console > Real-Time Events.
Each row is one send. Find the rows with SPLUNK in Endpoint Type, and read their Status Code.
A Status Code of 200 means Splunk accepted the batch. Streamed Lines gives the number of log lines in the batch.
Any status other than 200 is the answer of Splunk, except 503, which means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.