Checklist for using Splunk Nozzle to stream logs and metrics for PCF

Products

• Operations Manager

Resolution

Checklist:

Many users attempt to choose Logs and Metric nozzles in Pivotal Cloud Foundry (PCF). More specifically, Splunk is a nozzle that is used often by users.

However, when people search for information on Splunk, it is widely spread out and hard to find. Hence, this article will act as a central location for all documents and information pertaining to Splunk. 

A short introduction about the Splunk Nozzle can be found in Pivotal Documentation. "The Splunk Firehose Nozzle for PCF Tile streams logs and metrics from PCF and forwards them to user-specified Splunk Enterprise indexers configured to receive data via HTTP Event Collector. PCF operators and Splunk users can immediately search and analyze PCF Firehose data from their Splunk Enterprise deployment to build reports, dashboards, and alerts on the health and performance of their apps."

Splunk is a Partner tile and as a result, there is both OSS Splunk Documentation and Pivotal Documentation. References to both will be listed below.
The following list will assist you in finding Splunk Nozzle documentation and resources.

• Download the Splunk Nozzle for PCF from: https://network.pivotal.io/products/splunk-nozzle/
• Get started with the Splunk Nozzle for PCF using Pivotal Partner Documentation. This is a good starting point to get familiar with the Splunk Nozzle.
• For installing and configuring the Splunk Firehose Nozzle for PCF, refer to the following Documentation: https://docs.pivotal.io/partners/splunk/installing.htm
• Release notes for each version (the latest version is 1.0.2) of Splunk Nozzle can be found here: https://docs.pivotal.io/partners/splunk/release-notes.html
• To understand the Splunk Nozzle architecture, refer the following Documentation: https://docs.pivotal.io/partners/splunk/architecture.html
• For information on how to stream application logs to Splunk, refer to this Documentation: https://docs.pivotal.io/pivotalcf/2-4/devguide/services/integrate-splunk.html

Note: Splunk is a Partner tile and not developed in Pivotal. However, Pivotal recommends referring to the external references below:

• To know everything about Splunk, refer to the Enterprise Splunk Documentation here: https://docs.splunk.com/Documentation/Splunk

• To see the code, check out the Open Source Project location for the Splunk Firehose Nozzle: https://github.com/cloudfoundry-community/splunk-firehose-nozzle

Refer to the following link for information on Splunk Support terms and how to reach Splunk Support: https://www.splunk.com/en_us/support-and-services.htm

Additional Information

Blogs and articles on PCF and Splunk:

• https://www.splunk.com/blog/2017/10/06/splunk-and-pivotal-cloud-foundry-get-the-new-nozzle.html
• https://www.splunk.com/blog/2018/04/06/pivotal-cloud-foundry-health-monitoring.html
• https://www.splunk.com/blog/2017/01/19/getting-cloud-native-with-splunk-and-cloud-foundry.html

Splunk PCF architecture introduction video play list:

• Overview and introduction: https://www.youtube.com/watch?v=hSt2AJB4Tm
• Part 2, 3 and 4 can be found here in the following play list: https://www.youtube.com/watch?v=kCWBARbVAc4&list=PLjeC_l7KuNEHJEWLaK3WVt8wsfS8jgwVG