> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/destinations/splunk-observability-cloud.md). # Splunk Observability Cloud The Splunk Observability Cloud destination sends logs, metrics, and traces to [Splunk Observability Cloud](https://docs.splunk.com/observability/en/) (formerly SignalFx). Metrics are sent through the SignalFx ingest API, logs through the Splunk HEC log endpoint, and traces through the OTLP/HTTP trace endpoint. The ingest endpoints are derived from the selected API realm. ### Supported Telemetry Types | Platform | Metrics | Logs | Traces | | -------- | ------- | ---- | ------ | | Linux | ✓ | ✓ | ✓ | | Windows | ✓ | ✓ | ✓ | | macOS | ✓ | ✓ | ✓ | ### Prerequisites * A Splunk Observability Cloud organization with an access token. The token must have ingest permission for the telemetry types you plan to send. See [Create and manage authentication tokens](https://docs.splunk.com/observability/en/admin/authentication/authentication-tokens/org-tokens.html). * Your organization's [API realm (region)](https://docs.splunk.com/observability/en/get-started/service-description.html#sd-regions), for example `us0`, `eu0`, or `jp0`. The ingest endpoints are built from this realm. * Network egress from the collector to `https://ingest..signalfx.com` and `https://api..signalfx.com`. ### Configuration
Bindplane docs - Splunk Observability Cloud - image 1
#### General | Parameter | Type | Default | Description | | --------------------- | ------------------ | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Choose Telemetry Type | Telemetry Selector | `["Logs", "Metrics", "Traces"]` | The types of telemetry data to send. Valid values: `Logs`, `Metrics`, `Traces`. | | Token | String | | **Required.** Sensitive. Token used to authenticate with the Splunk (SignalFx) metric, trace, and log APIs. | | API Realm (region) | Enum | `us0` | The Splunk API realm (region) to use when sending metrics, traces, and logs. Valid values: `au0`, `us0`, `us1`, `us2`, `eu0`, `eu1`, `eu2`, `jp0`. Custom realms can also be entered. | #### Advanced | Parameter | Type | Default | Description | | ------------------ | ------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Splunk Ingest URL | String | | The base Splunk ingest URL for sending traces. When empty, it is built from the selected realm (`https://ingest..signalfx.com`). Override for a custom or private ingest endpoint. Applies only when Traces is selected. | | Drop Raw Copy | Boolean | `true` | When enabled, the raw copy of the log stored in `log.record.original` is dropped. | | Sync Host Metadata | Boolean | `true` | When enabled, host metadata is scraped and sent as property updates, and the resourcedetection processor overrides existing resource attributes (including `host.name`) with detected values. Disable to preserve resource attributes set upstream in the pipeline. | #### Retry on Failure | Parameter | Type | Default | Description | | ----------------------- | ------- | ------- | ----------------------------------------------------------------------------------------------------------- | | Enable Retry on Failure | Boolean | `true` | Attempt to resend telemetry data that has failed to be transmitted to the destination. | | Initial interval | Integer | `5` | Time (in seconds) to wait after the first failure before retrying. Applies when retry is enabled. | | Max interval | Integer | `30` | The upper bound (in seconds) on backoff. Applies when retry is enabled. | | Max elapsed time | Integer | `300` | The maximum time (in seconds) spent trying to send a batch before giving up. Applies when retry is enabled. | #### Sending Queue | Parameter | Type | Default | Description | | ------------------------- | --------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | Enable Sending Queue | Boolean | `true` | Buffer telemetry data temporarily before sending to help avoid loss during a temporary network outage. | | Number of Consumers | Integer | `10` | Number of consumers that dequeue batches. Applies when the sending queue is enabled. | | Queue Size | Integer | `5000` | Maximum number of batches kept in memory before dropping. Applies when the sending queue is enabled. | | Enable Persistent Queuing | Boolean | `true` | Buffer telemetry data to disk before sending to help avoid loss during outages or collector restarts. Applies when the sending queue is enabled. | | Persistent Queue Storage | Extension | `file_storage_persistent_queue` | The storage to use for the persistent queue. Applies when the sending queue and persistent queue are enabled. | ### Example Configuration #### Standalone Destination ```yaml apiVersion: bindplane.observiq.com/v1 kind: Destination metadata: id: signalfx name: signalfx spec: type: signalfx parameters: - name: telemetry_types value: ['Logs', 'Metrics', 'Traces'] - name: token value: 'my-access-token' - name: realm value: 'us0' ``` ### Configuration Tips #### Choosing an API realm * Set `realm` to your organization's region, which you can find in the Splunk Observability Cloud UI. The realm determines which endpoints Bindplane sends to (see [API endpoints](#api-endpoints)). See [Splunk Observability Cloud regions](https://docs.splunk.com/observability/en/get-started/service-description.html#sd-regions). #### API endpoints Bindplane sends each signal type to a different Splunk Observability Cloud (SignalFx) API, all derived from your selected **API Realm**: | Signal | Splunk API | Endpoint | | ------- | --------------- | --------------------------------------------------- | | Metrics | SignalFx ingest | `https://ingest..signalfx.com` | | Logs | Splunk HEC | `https://ingest..signalfx.com/v1/log` | | Traces | OTLP/HTTP | `https://ingest..signalfx.com/v2/trace/otlp` | SignalFx API calls (for example, host-metadata sync) use `https://api..signalfx.com`. To send traces to a custom or private ingest endpoint, set `splunk_ingest_url` to override the realm-derived trace ingest URL. #### Resource attributes and host metadata * Leave `sync_host_metadata` enabled to have the collector report host metadata to Splunk Observability Cloud and detect resource attributes such as `host.name`. Disable it when an upstream processor already sets these attributes and you do not want them overridden. #### Logs * When `drop_raw_copy` is enabled (the default), the original log copy in `log.record.original` is removed before sending, which reduces payload size. Disable it if you need the raw record preserved at the destination. ### Troubleshooting **Symptom:** Telemetry is rejected with a 401 or authentication error. **Solution:** Confirm the `token` is a valid Splunk Observability Cloud access token with ingest permission for the telemetry types you are sending, and that it belongs to the same organization as the selected `realm`. **Symptom:** Data is sent but never appears in Splunk Observability Cloud, or connections fail. **Solution:** Verify the `realm` matches your organization's region. A mismatched realm points the collector at the wrong ingest endpoint. Confirm the collector can reach `https://ingest..signalfx.com`. **Symptom:** Resource attributes set earlier in the pipeline (such as `host.name`) are being overwritten. **Solution:** Disable `sync_host_metadata`. When enabled, the resourcedetection processor overrides existing resource attributes with values detected from the host. ### Related Resources * [Splunk Observability Cloud documentation](https://docs.splunk.com/observability/en/) * [Splunk Observability Cloud regions (realms)](https://docs.splunk.com/observability/en/get-started/service-description.html#sd-regions) * [Create and manage organization access tokens](https://docs.splunk.com/observability/en/admin/authentication/authentication-tokens/org-tokens.html) * [Retry on Failure settings](https://docs.bindplane.com/configuration/bindplane-otel-collector/retry-on-failure) * [Sending Queue settings](https://docs.bindplane.com/configuration/bindplane-otel-collector/sending-queue) * [Persistent Queue settings](https://docs.bindplane.com/configuration/bindplane-otel-collector/persistent-queue) ``` ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bindplane.com/integrations/destinations/splunk-observability-cloud.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.