Splunk Log Integration

CloudAMQP ships broker logs to Splunk via HTTP Event Collector (HEC) using the CloudAMQP OpenTelemetry Collector. Available on RabbitMQ and LavinMQ dedicated instances.

For Splunk metrics via the OTel Collector, see the Splunk V2 metrics integration.

Link: https://www.splunk.com

Setup

1. In Splunk, go to Settings → Data inputs → HTTP Event Collector and create a new token.
2. On the token, you must set a default index — this is the destination where CloudAMQP events will land. Events do not include an explicit index field, so without a default index the token will reject them.
3. Indexer acknowledgement must be disabled on the token.
4. Your HEC URL looks something like https://<your-instance-id>.splunkcloud.com:443/services/collector
5. In the CloudAMQP console, enter the HEC endpoint, the token, and optionally a source type. Leave source type blank to use the token's default.
6. Click Save.

Log attributes

Each log record includes the following attributes:

• service.name — your CloudAMQP cluster name
• host.name — the individual node hostname, useful on multi-node clusters
• appname — always rabbitmq or lavinmq
• severity_text — Splunk exposes severity as a string (e.g. info, warning, error )

← Back to Log Integrations