# Splunk (TCP)

### Supported Platforms

| Platform           | Metrics | Logs | Traces |
| ------------------ | ------- | ---- | ------ |
| Linux              |         | ✓    |        |
| Windows            |         | ✓    |        |
| macOS              |         | ✓    |        |
| Kubernetes Gateway |         | ✓    |        |
| OpenShift Gateway  |         | ✓    |        |

### Configuration Table

<table><thead><tr><th width="235.08984375">Parameter</th><th width="99.26171875">Type</th><th width="105.4765625">Default</th><th>Description</th></tr></thead><tbody><tr><td>listen_ip</td><td><code>string</code></td><td>"0.0.0.0"</td><td>IP Address to listen on.</td></tr><tr><td>listen_port*</td><td><code>int</code></td><td></td><td>Port to listen on.</td></tr><tr><td>log_type</td><td><code>string</code></td><td>splunk_tcp</td><td>Arbitrary for attribute 'log_type'. Useful for filtering between many log sources.</td></tr><tr><td>parse_format</td><td><code>enum</code></td><td>none</td><td>Method to use when parsing. Valid values are <code>none</code>, <code>json</code>, and <code>regex</code>. When regex is selected, 'Regex Pattern' must be set.</td></tr><tr><td>regex_pattern</td><td><code>string</code></td><td></td><td>The regex pattern used when parsing log entries.</td></tr><tr><td>multiline_line_start_pattern</td><td><code>string</code></td><td></td><td>Regex pattern that matches the beginning of a log entry, for handling multiline logs.</td></tr><tr><td>multiline_line_end_pattern</td><td><code>string</code></td><td></td><td>Regex pattern that matches the end of a log entry, useful for terminating parsing of multiline logs.</td></tr><tr><td>parse_timestamp</td><td><code>bool</code></td><td>false</td><td>Whether to parse the timestamp from the log entry.</td></tr><tr><td>timestamp_field</td><td><code>string</code></td><td>timestamp</td><td>The field containing the timestamp in the log entry.</td></tr><tr><td>parse_timestamp_format</td><td><code>enum</code></td><td>ISO8601</td><td>The format of the timestamp in the log entry. Choose a common format, or specify a custom format. Options include "ISO8601", "RFC3339", "Epoch", and "Manual".</td></tr><tr><td>epoch_timestamp_format</td><td><code>enum</code></td><td>s</td><td>The layout of the epoch-based timestamp. Required when parse_timestamp_format is set to "Epoch".. Options include "s", "ms", "us", "ns", "s.ms", "s.us", "s.ns".</td></tr><tr><td>manual_timestamp_format</td><td><code>string</code></td><td>'%Y-%m-%dT%H:%M:%S.%f%z'</td><td>The strptime layout of the timestamp. Used when parse_timestamp_format is set to "Manual".</td></tr><tr><td>timezone</td><td><code>timezone</code></td><td>UTC</td><td>The timezone to use if the Timestamp Format doesn't include a timezone. Otherwise, the timezone in the Timestamp Format will be respected. <strong>NOTE: This is also required to parse timezone abbreviations, due to their ambiguity.</strong></td></tr><tr><td>parse_severity</td><td><code>bool</code></td><td>false</td><td>Whether to parse severity from the log entry.</td></tr><tr><td>severity_field</td><td><code>string</code></td><td>severity</td><td>The field containing the severity in the log entry.</td></tr><tr><td>parse_to</td><td><code>string</code></td><td>body</td><td>The <a href="https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/pkg/stanza/docs/types/field.md">field</a> that the log will be parsed to. Some exporters handle logs favorably when parsed to <code>attributes</code> over <code>body</code> and vice versa.</td></tr><tr><td>enable_tls</td><td><code>bool</code></td><td>false</td><td>Whether or not to use TLS.</td></tr><tr><td>tls_certificate_path</td><td><code>string</code></td><td></td><td>Path to the TLS cert to use for TLS-required connections.</td></tr><tr><td>tls_private_key_path</td><td><code>string</code></td><td></td><td>Path to the TLS key to use for TLS-required connections.</td></tr><tr><td>tls_min_version</td><td><code>enum</code></td><td>"1.2"</td><td>The minimum TLS version to support. 1.0 and 1.1 should not be considered secure. Valid values include: <code>1.3</code>, <code>1.2</code>, <code>1.1</code>, <code>1.0</code>.</td></tr></tbody></table>

<mark style="color:red;">\*</mark>*<mark style="color:red;">required field</mark>*

### Kubernetes

The Splunk TCP source type supports Kubernetes Gateway collectors. Splunk forwarders can send logs to the collectors using the clusterIP services.

#### Prerequisites

* Bindplane v1.46.0 or newer

#### Configuration

Add the Splunk TCP source to your Gateway collector configuration. Set "Listen Address" to `0.0.0.0` and Listen Port to `9997`.

The Splunk forwarders should be configured to forward telemetry to `bindplane-gateway-collector.bindplane-collector.svc.cluster.local`on port `9997`. If the Splunk forwarders live outside of the cluster, you must make the `bindplane-gateway-collector`service in the `bindplane-collector` namespace available using TCP ingress or by defining your own service that can receive traffic from outside of the cluster. See the Kubernetes [service documentation](https://kubernetes.io/docs/tutorials/kubernetes-basics/expose/expose-intro/) for more information.

Below is an example Splunk forwarder outputs configuration.

```ini
[tcpout]
defaultGroup = bindplane-gateway-collector

[tcpout:bindplane-gateway-collector]
server = bindplane-gateway-collector.bindplane-collector.svc.cluster.local:9997
compressed = false
useACK = false
sendCookedData = false
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.bindplane.com/integrations/sources/splunk-tcp.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.