Splunk Observability Cloud

The Splunk Observability Cloud destination sends logs, metrics, and traces to Splunk Observability Cloud (formerly SignalFx). Metrics are sent through the SignalFx ingest API, logs through the Splunk HEC log endpoint, and traces through the OTLP/HTTP trace endpoint. The ingest endpoints are derived from the selected API realm.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux	✓	✓	✓
Windows	✓	✓	✓
macOS	✓	✓	✓

Prerequisites

• A Splunk Observability Cloud organization with an access token. The token must have ingest permission for the telemetry types you plan to send. See Create and manage authentication tokens.
• Your organization's API realm (region), for example us0, eu0, or jp0. The ingest endpoints are built from this realm.
• Network egress from the collector to https://ingest.<realm>.signalfx.com and https://api.<realm>.signalfx.com.

Configuration

General

Parameter	Type	Default	Description
Choose Telemetry Type	Telemetry Selector	["Logs", "Metrics", "Traces"]	The types of telemetry data to send. Valid values: Logs, Metrics, Traces.
Token	String		Required. Sensitive. Token used to authenticate with the Splunk (SignalFx) metric, trace, and log APIs.
API Realm (region)	Enum	us0	The Splunk API realm (region) to use when sending metrics, traces, and logs. Valid values: au0, us0, us1, us2, eu0, eu1, eu2, jp0. Custom realms can also be entered.

Advanced

Parameter	Type	Default	Description
Splunk Ingest URL	String		The base Splunk ingest URL for sending traces. When empty, it is built from the selected realm (https://ingest.<realm>.signalfx.com). Override for a custom or private ingest endpoint. Applies only when Traces is selected.
Drop Raw Copy	Boolean	true	When enabled, the raw copy of the log stored in log.record.original is dropped.
Sync Host Metadata	Boolean	true	When enabled, host metadata is scraped and sent as property updates, and the resourcedetection processor overrides existing resource attributes (including host.name) with detected values. Disable to preserve resource attributes set upstream in the pipeline.

Retry on Failure

Parameter	Type	Default	Description
Enable Retry on Failure	Boolean	true	Attempt to resend telemetry data that has failed to be transmitted to the destination.
Initial interval	Integer	5	Time (in seconds) to wait after the first failure before retrying. Applies when retry is enabled.
Max interval	Integer	30	The upper bound (in seconds) on backoff. Applies when retry is enabled.
Max elapsed time	Integer	300	The maximum time (in seconds) spent trying to send a batch before giving up. Applies when retry is enabled.

Sending Queue

Parameter	Type	Default	Description
Enable Sending Queue	Boolean	true	Buffer telemetry data temporarily before sending to help avoid loss during a temporary network outage.
Number of Consumers	Integer	10	Number of consumers that dequeue batches. Applies when the sending queue is enabled.
Queue Size	Integer	5000	Maximum number of batches kept in memory before dropping. Applies when the sending queue is enabled.
Enable Persistent Queuing	Boolean	true	Buffer telemetry data to disk before sending to help avoid loss during outages or collector restarts. Applies when the sending queue is enabled.
Persistent Queue Storage	Extension	file_storage_persistent_queue	The storage to use for the persistent queue. Applies when the sending queue and persistent queue are enabled.

Example Configuration

Standalone Destination

apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  id: signalfx
  name: signalfx
spec:
  type: signalfx
  parameters:
    - name: telemetry_types
      value: ['Logs', 'Metrics', 'Traces']
    - name: token
      value: 'my-access-token'
    - name: realm
      value: 'us0'

Configuration Tips

Choosing an API realm

• Set realm to your organization's region, which you can find in the Splunk Observability Cloud UI. The realm determines which endpoints Bindplane sends to (see API endpoints). See Splunk Observability Cloud regions.

API endpoints

Bindplane sends each signal type to a different Splunk Observability Cloud (SignalFx) API, all derived from your selected API Realm:

Signal	Splunk API	Endpoint
Metrics	SignalFx ingest	https://ingest.<realm>.signalfx.com
Logs	Splunk HEC	https://ingest.<realm>.signalfx.com/v1/log
Traces	OTLP/HTTP	https://ingest.<realm>.signalfx.com/v2/trace/otlp

SignalFx API calls (for example, host-metadata sync) use https://api.<realm>.signalfx.com.

To send traces to a custom or private ingest endpoint, set splunk_ingest_url to override the realm-derived trace ingest URL.

Resource attributes and host metadata

• Leave sync_host_metadata enabled to have the collector report host metadata to Splunk Observability Cloud and detect resource attributes such as host.name. Disable it when an upstream processor already sets these attributes and you do not want them overridden.

Logs

• When drop_raw_copy is enabled (the default), the original log copy in log.record.original is removed before sending, which reduces payload size. Disable it if you need the raw record preserved at the destination.

Troubleshooting

Symptom: Telemetry is rejected with a 401 or authentication error. Solution: Confirm the token is a valid Splunk Observability Cloud access token with ingest permission for the telemetry types you are sending, and that it belongs to the same organization as the selected realm.

Symptom: Data is sent but never appears in Splunk Observability Cloud, or connections fail. Solution: Verify the realm matches your organization's region. A mismatched realm points the collector at the wrong ingest endpoint. Confirm the collector can reach https://ingest.<realm>.signalfx.com.

Symptom: Resource attributes set earlier in the pipeline (such as host.name) are being overwritten. Solution: Disable sync_host_metadata. When enabled, the resourcedetection processor overrides existing resource attributes with values detected from the host.

Related Resources

• Splunk Observability Cloud documentation
• Splunk Observability Cloud regions (realms)
• Create and manage organization access tokens
• Retry on Failure settings
• Sending Queue settings
• Persistent Queue settings