Splunk Hec Exporter - unparsed raw event output

[greatestusername-splunk]

Component(s)

exporter/splunkhec

Is your feature request related to a problem? Please describe.

Ability to send data out to splunk instance as raw text using the raw endpoint.

Currently exporter munges incoming logs into a "hec formatted" event. Adding fields such as host and jamming all of the raw payload into event.

Would be amazing to have a setting to just pass raw through unparsed and have it be treated as raw at splunk index time.

This would enable using the https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/splunkhecreceiver receiver as a generic webhook receiver, that can then be passed easily on to splunk while handling token auth.

Describe the solution you'd like

A setting to just pass raw through unparsed and have it be treated as raw at splunk index time.

This would enable using the https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/splunkhecreceiver receiver as a generic webhook receiver, that can then be passed easily on to splunk while handling header auth.

Describe alternatives you've considered

Not certain there are other options.

Additional context

If there is a better way to get generic webhook data out to Splunk as raw text from otel, would be happy to know!

[github-actions]

Pinging code owners:

• exporter/splunkhec: @atoulme @dmitryax

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[atoulme]

That's definitely doable, for logs only obviously. To reiterate some of what we talked about directly:

• This means you lose any metadata - including index, timestamp, etc. Maybe you can cheat and add this metadata to the hec url.
• Only works for logs, obviously.

[greatestusername-splunk]

Definitely! All sorta goes without saying but MUST be said!
Timestamp will be fine added at index time for most use cases. Any that don't should include times/timestamps/epoch or some other data anyway. If they don't... more magic tricks can get it there. :)

[atoulme]

Done!

[greatestusername-splunk]

You're the very best! like no one ever was! 🎵
TY!