# Splunk (TCP)

### Supported Platforms

| Platform           | Metrics | Logs | Traces |
| ------------------ | ------- | ---- | ------ |
| Linux              |         | ✓    |        |
| Windows            |         | ✓    |        |
| macOS              |         | ✓    |        |
| Kubernetes Gateway |         | ✓    |        |
| OpenShift Gateway  |         | ✓    |        |

### Configuration Table

<table><thead><tr><th width="235.08984375">Parameter</th><th width="99.26171875">Type</th><th width="105.4765625">Default</th><th>Description</th></tr></thead><tbody><tr><td>listen_ip</td><td><code>string</code></td><td>"0.0.0.0"</td><td>IP Address to listen on.</td></tr><tr><td>listen_port*</td><td><code>int</code></td><td></td><td>Port to listen on.</td></tr><tr><td>log_type</td><td><code>string</code></td><td>splunk_tcp</td><td>Arbitrary for attribute 'log_type'. Useful for filtering between many log sources.</td></tr><tr><td>parse_format</td><td><code>enum</code></td><td>none</td><td>Method to use when parsing. Valid values are <code>none</code>, <code>json</code>, and <code>regex</code>. When regex is selected, 'Regex Pattern' must be set.</td></tr><tr><td>regex_pattern</td><td><code>string</code></td><td></td><td>The regex pattern used when parsing log entries.</td></tr><tr><td>multiline_line_start_pattern</td><td><code>string</code></td><td></td><td>Regex pattern that matches the beginning of a log entry, for handling multiline logs.</td></tr><tr><td>multiline_line_end_pattern</td><td><code>string</code></td><td></td><td>Regex pattern that matches the end of a log entry, useful for terminating parsing of multiline logs.</td></tr><tr><td>parse_timestamp</td><td><code>bool</code></td><td>false</td><td>Whether to parse the timestamp from the log entry.</td></tr><tr><td>timestamp_field</td><td><code>string</code></td><td>timestamp</td><td>The field containing the timestamp in the log entry.</td></tr><tr><td>parse_timestamp_format</td><td><code>enum</code></td><td>ISO8601</td><td>The format of the timestamp in the log entry. Choose a common format, or specify a custom format. Options include "ISO8601", "RFC3339", "Epoch", and "Manual".</td></tr><tr><td>epoch_timestamp_format</td><td><code>enum</code></td><td>s</td><td>The layout of the epoch-based timestamp. Required when parse_timestamp_format is set to "Epoch".. Options include "s", "ms", "us", "ns", "s.ms", "s.us", "s.ns".</td></tr><tr><td>manual_timestamp_format</td><td><code>string</code></td><td>'%Y-%m-%dT%H:%M:%S.%f%z'</td><td>The strptime layout of the timestamp. Used when parse_timestamp_format is set to "Manual".</td></tr><tr><td>timezone</td><td><code>timezone</code></td><td>UTC</td><td>The timezone to use if the Timestamp Format doesn't include a timezone. Otherwise, the timezone in the Timestamp Format will be respected. <strong>NOTE: This is also required to parse timezone abbreviations, due to their ambiguity.</strong></td></tr><tr><td>parse_severity</td><td><code>bool</code></td><td>false</td><td>Whether to parse severity from the log entry.</td></tr><tr><td>severity_field</td><td><code>string</code></td><td>severity</td><td>The field containing the severity in the log entry.</td></tr><tr><td>parse_to</td><td><code>string</code></td><td>body</td><td>The <a href="https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/pkg/stanza/docs/types/field.md">field</a> that the log will be parsed to. Some exporters handle logs favorably when parsed to <code>attributes</code> over <code>body</code> and vice versa.</td></tr><tr><td>enable_tls</td><td><code>bool</code></td><td>false</td><td>Whether or not to use TLS.</td></tr><tr><td>tls_certificate_path</td><td><code>string</code></td><td></td><td>Path to the TLS cert to use for TLS-required connections.</td></tr><tr><td>tls_private_key_path</td><td><code>string</code></td><td></td><td>Path to the TLS key to use for TLS-required connections.</td></tr><tr><td>tls_min_version</td><td><code>enum</code></td><td>"1.2"</td><td>The minimum TLS version to support. 1.0 and 1.1 should not be considered secure. Valid values include: <code>1.3</code>, <code>1.2</code>, <code>1.1</code>, <code>1.0</code>.</td></tr></tbody></table>

<mark style="color:red;">\*</mark>*<mark style="color:red;">required field</mark>*

### Kubernetes

The Splunk TCP source type supports Kubernetes Gateway collectors. Splunk forwarders can send logs to the collectors using the clusterIP services.

#### Prerequisites

* Bindplane v1.46.0 or newer

#### Configuration

Add the Splunk TCP source to your Gateway collector configuration. Set "Listen Address" to `0.0.0.0` and Listen Port to `9997`.

The Splunk forwarders should be configured to forward telemetry to `bindplane-gateway-collector.bindplane-collector.svc.cluster.local`on port `9997`. If the Splunk forwarders live outside of the cluster, you must make the `bindplane-gateway-collector`service in the `bindplane-collector` namespace available using TCP ingress or by defining your own service that can receive traffic from outside of the cluster. See the Kubernetes [service documentation](https://kubernetes.io/docs/tutorials/kubernetes-basics/expose/expose-intro/) for more information.

Below is an example Splunk forwarder outputs configuration.

```ini
[tcpout]
defaultGroup = bindplane-gateway-collector

[tcpout:bindplane-gateway-collector]
server = bindplane-gateway-collector.bindplane-collector.svc.cluster.local:9997
compressed = false
useACK = false
sendCookedData = false
```