Iscriviti al feed

Red Hat OpenShift already provides an aggregated logging solution based on the EFK stack, fully integrated with the platform. But we also provide choice for companies that have settled on a different platform.

Some companies have a Splunk logging platform to store and to aggregate the logs for all their environments and they want to send their container logs to the same platform.

This post explains how to easily integrate Splunk with Red Hat OpenShift using the new  Splunk Connect for Kubernetes. The first part is focused on how to use Splunk Kubernetes Logging.


  • Splunk Enterprise 7.0 or later
  • An HEC token used by the HTTP Event Collector to authenticate the event data.
  • Have a minimum of two Splunk indexes ready to collect the log data, one for both logs and Kubernetes objects, and one for metrics. You can also create separate indexes for logs and objects, in which case you will need three Splunk indexes.
  • Helm

More information here: Splunk Connect Prerequistes


Splunk Connect for Kubernetes deploys:

  • One DaemonSet on each OpenShift node for collecting log.
  • One DaemonSet on each OpenShift node for collecting metrics.
  • One Deployment to collect OpenShift Objects changes.

Configure Splunk Connect project

Create Project

First of all, create the target project.

oc adm new-project splunk-connect --node-selector=""
oc project splunk-connect

The node-selector is necessary to allow the daemonset to run in all the nodes.

Configure HELM

Create tiller Service Account and relative role admin. Tiller must be able to edit the project.

oc create sa tiller
oc adm policy add-role-to-user admin -z tiller

Deploy tiller.

helm init --override 'spec.template.spec.containers[0].command'='{/tiller,--storage=secret,--listen=localhost:44134}' \
--service-account=tiller \

Information about securing HELM:

HELM Security

Securing HELM installation

Tillerless HELM

HELM Template

Note: We're using Helm here because it's what's supported by Splunk Connect. However, our supported way to define and install applications is using OpenShift Templates  and Ansible.


Download the latest Helm Splunk Kubernetes Logging Helm package, which at the time of writing is 1.1.0.

wget <a href=""></a>

Configure the variables for Helm, you can find sample values on GitHub:

Minimal value example:

     port: 8080
     token: xxxxxx-xxxx-xxxx-xxx-xxxxxxxxx
     protocol: https

Splunk Kubernetes Logging

Splunk Kubernetes Logging uses the Kubernetes node logging agent to collect logs. Splunk deploys a daemonset on each of these nodes. Each daemonset holds a Fluentd container to collect the data.


  1. Create service account for logging.
oc create sa splunk-kubernetes-logging

2. Assign privileged permission.

oc adm policy add-scc-to-user privileged -z splunk-kubernetes-logging

    Logging pods need access to /var/log/*

3. Install Helm package

helm install --tiller-namespace=splunk-connect --name splunk-kubernetes-logging -f logging-value.yml splunk-kubernetes-logging-1.1.0.tgz

4. The following patch adds privileged=true securityContext and service account splunk-kubernetes-logging.

oc patch ds splunk-kubernetes-logging -p '{
                 "serviceAccountName": "splunk-kubernetes-logging",
5. Delete the pods to apply the latest patch.
oc delete pods -lapp=splunk-kubernetes-logging

Verify on Splunk


Splunk OpenShift Web Console Extension

The OpenShift Web Console provides a way to customize its layout, and with this extension we are able to easily access the Splunk log for a specific container from OpenShift Web Console.


  1. Deploy the OpenShift web console extension
oc project openshift-web-console
oc new-app --name=ext -lapp=ext --context-dir=/app
oc patch dc ext -p '{
                "spec": {
                    "template": {
                        "spec": {
                            "nodeSelector": {
                                "": "true"
oc scale --replicas=3 dc/ext
oc create route edge --service=ext

2. Update the extensions section of the webconsole-config configmap based on your settings.

       splunkURL: ""
       splunkQueryPrefix: "/app/search/search?q=search%20"
       splunkApplicationIndex: 'ocp_logging'
       splunkSystemIndex: 'ocp_system'
       splunkSystemNamespacePattern: '^(openshift|kube|splunk|istio|default)\-?.*'
Properties Description Optional
splunkURL Splunk Web Console Endpoint N
splunkQueryPrefix Search Context Path N
splunkApplicationIndex Index for application log N
splunkSystemIndex Index For infrastructure log Y
splunkSystemNamespacePattern Identify which namespace contains infrastructure log Y


3. Rollout the openshift-web-console deployment.

oc delete pod -lapp=openshift-web-console

4. Splunk Extension outcome.


In this article we have explored how we can forward applications log to Splunk.

In the next post will see how to collect OpenShift/Kubernetes metrics and Kubernetes objects to Splunk.


Ricerca per canale

automation icon


Novità sull'automazione IT di tecnologie, team e ambienti

AI icon

Intelligenza artificiale

Aggiornamenti sulle piattaforme che consentono alle aziende di eseguire carichi di lavoro IA ovunque

open hybrid cloud icon

Hybrid cloud open source

Scopri come affrontare il futuro in modo più agile grazie al cloud ibrido

security icon


Le ultime novità sulle nostre soluzioni per ridurre i rischi nelle tecnologie e negli ambienti

edge icon

Edge computing

Aggiornamenti sulle piattaforme che semplificano l'operatività edge

Infrastructure icon


Le ultime novità sulla piattaforma Linux aziendale leader a livello mondiale

application development icon


Approfondimenti sulle nostre soluzioni alle sfide applicative più difficili

Original series icon

Serie originali

Raccontiamo le interessanti storie di leader e creatori di tecnologie pensate per le aziende