Outcold Solutions - Monitoring Kubernetes, OpenShift and Docker in Splunk
Kubernetes Search in Splunk Monitoring Docker in Splunk Monitoring Kubernetes in Splunk Monitoring OpenShift in Splunk Monitoring Linux in Splunk Monitoring Windows Containers in Splunk Forwarding Logs to Elasticsearch and OpenSearch Forwarding Logs to QRadar
Documentation Blog Contact Us Upload support diagnostics Pricing Evaluation licenses Partners License Agreement Privacy Policy Refund & Cancellation Acceptable Use Policy FAQ
Kubernetes Search

Requirements

The short version: a Splunk Enterprise search head, a network route from it to each cluster, and a credential per cluster. The details below are the full compatibility picture.

Splunk

Splunk Enterprise9.4, 10.0, 10.2, and 10.4 (tested)
Splunk CloudSupported
Install locationSearch head only
Search head clusteringSupported, with a paid license

There is no indexer or forwarder component, and the app writes nothing to an index - it installs on search heads alone.

Search head platform

The bundled binary ships for these search-head operating systems and architectures:

  • Linux: amd64, arm64
  • Windows: amd64
  • macOS: amd64, arm64

Kubernetes

Kubernetes API1.20 or later
API discoveryAggregated discovery on 1.26 and later, with a fallback for older clusters

Any conformant distribution works - the app talks to the standard Kubernetes API. Managed services (EKS, GKE, AKS) and self-hosted clusters are supported when the search head can reach the API server and you provide one of the credential forms below.

Network

Outbound HTTPS from the search head to each cluster’s API server. The search head is what connects to your clusters, so routes and firewall rules apply there, not on indexers or forwarders.

Credentials

One credential per cluster - a bearer token or a client certificate - kept in Splunk’s encrypted credential store. Manual registration accepts either form. Kubeconfig import accepts an inline token, or inline client-certificate-data plus client-key-data.

Kubeconfigs that depend on an exec credential plugin (including the usual managed-service login helpers), tokenFile, or certificate/key file paths cannot be imported directly. Resolve the credential first and provide it inline. See Clusters for setup instructions and how to obtain a least-privilege credential.

Licensing

The free tier needs no key: one cluster on a single standalone search head. Multiple clusters, search head clustering, per-user credentials, and impersonation require a paid license. See Licensing.