How to ingest data from ForgeRock app --OpenTelemetry(Java) -- Splunk

[Rockstar2107]

How to ingest data from ForgeRock API --> OpenTelemetry(Java) --> Splunk? Can anyone throw me some idea or steps to kick start the integration.

[anuraaga]

Hi @Rockstar2107 - could you describe how you access the ForgeRock API? I tried looking around a bit but couldn't find the Java SDK for it. Normally we'd expect registering an interceptor to it if it supports it, or otherwise wrapping it, to create spans around the API calls. Then you could point the OTLP exporter to the Splunk endpoint to ingest them.

[Rockstar2107]

Hi Anuraaga, thanks for responding, hey I had gone through this link in ForgeRock document on how to record the audit data into splunk.

https://backstage.forgerock.com/docs/ig/7/maintenance-guide/audit-splunk.html

Where they have used the Splunk HEC token and provided token details in the 30-splunk.json.

"Normally we'd expect registering an interceptor to it if it supports it, or otherwise wrapping it, to create spans around the API calls" -- I did not understand this statement so could you please explain me what you mean by "interceptor" and OTLP exporter.

[anuraaga]

Thanks for the link - is Identity Gateway a binary you run? In that case I guess you don't have any actual code to add OpenTelemetry to - otherwise, if you were to actually build an Identity Gateway with custom code, then an OpenTelemetry AuditEventHandler could probably be implemented for generating telemetry.

https://backstage.forgerock.com/docs/ig/7/apidocs/org/forgerock/audit/events/handlers/AuditEventHandler.html

It seems that guide describes how to ingest IG events into splunk directly and is probably the way to do it and wouldn't need adding OpenTelemetry - is there something else you're trying to achieve by adding OpenTelemetry to the mix?

[Rockstar2107]

Hey actually we wanted to get the ForgeRock (Metrics, Traces and Event logs) in to splunk but there is additional application called "open telemetry" between ForgeRock and Splunk, client wanted to see whatever the details captured from ForgeRock to open telemetry should see the same details in Splunk.

[Rockstar2107]

We have already implemented the same into New Relic application using the Jar file and it is working fine.
https://libraries.io/maven/com.newrelic.telemetry:newrelic-opentelemetry-javaagent

[jkwatson]

@Rockstar2107 What company do you work for, so we can find the appropriate resource to help you out with this? Thanks!

[Rockstar2107]

I am working in Infosys and this POC is our of financial client.

[jkwatson]

Great. I'm finding you a resource at Splunk who can assist with your particular case.

[Rockstar2107]

Hi Watson,

Good Morning, hey what are the pre-requisites and pre task which needs to considered for getting the open telemetry data into Splunk.

[jkwatson]

@Rockstar2107 I'm definitely not an expert here (I'm still tracking down a Splunk internal resource for you). But, I think the basic steps are these:

1. Install the otel collector with the splunk HEC exporter configured to export to your Splunk Enterprise instance
2. Point your java agent/sdk at the collector for all OTLP exports
3. that's it!