RSPEED-2326: feat(observability): add Splunk HEC integration #1032
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
major
changed the title
major
force-pushed
the
rspeed-2326-splunk-config
branch
from
c23203f to
7a0fd52
Compare
4 tasks
major
force-pushed
the
rspeed-2326-splunk-config
branch
from
7a0fd52 to
8c3acd2
Compare
Add SplunkConfiguration Pydantic model for Splunk HEC settings: - enabled: toggle for Splunk integration - url: HEC endpoint URL - token_path: path to HEC auth token file - index: target Splunk index - source: event source identifier (default: lightspeed-stack) - timeout: HTTP timeout in seconds (default: 5) - verify_ssl: SSL verification toggle (default: True) Add splunk and deployment_environment fields to Configuration class. Signed-off-by: Major Hayden <major@redhat.com>
Create new observability package for telemetry and event collection. Export send_splunk_event and build_inference_event as public API. Signed-off-by: Major Hayden <major@redhat.com>
Implement send_splunk_event() async function for sending events to Splunk: - Uses aiohttp for async HTTP requests - Reads HEC token from file path - Graceful degradation when config missing/disabled - Logs warnings on send failures (no exceptions raised) Add splunk and deployment_environment properties to AppConfig. Signed-off-by: Major Hayden <major@redhat.com>
…api v1 Implement build_inference_event() matching rlsapi Splunk event format: - InferenceEventData dataclass for structured input - Handles auth_disabled case for org_id/system_id - Maps all fields from request data and configuration - Empty placeholders for RAG fields (not yet implemented) Signed-off-by: Major Hayden <major@redhat.com>
tisnik
approved these changes
Jan 23, 2026
Contributor
tisnik
left a comment
tisnik
left a comment
There was a problem hiding this comment.
LGTM, interesting addition
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Add Splunk HEC (HTTP Event Collector) integration for sending inference telemetry events, matching the rlsapi v1 event format.
This PR includes:
SplunkConfigurationPydantic model with validationobservability.formatssubpackage)deployment_environmentconfig field for telemetryCommits
feat(config): add SplunkConfiguration model and fields
SplunkConfigurationwith enabled, url, token_path, index, source, timeout, verify_ssldeployment_environmentfield in Configurationfeat(observability): add observability package structure
src/observability/package with public exportsfeat(observability): add async Splunk HEC client
read_token_from_file()for secure token loadingsend_splunk_event()async function using aiohttpfeat(observability): add inference event builder for rlsapi v1
InferenceEventDatadataclass for type-safe event databuild_inference_event()inobservability.formats.rlsapimoduleformats/for custom event formatsType of change
Tools used to create PR
Related Tickets & Documents
Checklist before requesting a review
Testing
22 new tests across 3 test files:
tests/unit/models/config/test_splunk_configuration.py(11 tests)tests/unit/observability/test_splunk.py(9 tests)tests/unit/observability/formats/test_rlsapi.py(2 tests)