Monitoring Kubernetes
Forward Kubernetes logs, metrics, and events to Splunk.
Stream container logs, metadata-enriched metrics, audit logs, and Kubernetes events from any cluster into a Splunk events or metrics index - with dashboards that lead you to what needs fixing, and an Alert Catalog each team scopes to its own clusters and namespaces.
Installation
Set up the Splunk app and HEC, and deploy Collectord
→Concepts
What Collectord does, the data model, and how configuration layers
→Configuration
Deployment file structure and Collectord settings
→Dashboards
What each page of the app is for, menu by menu
→Annotations
Control index routing, log discovery, multiline, and field extraction per pod
→Annotations reference
Full list of every annotation grouped by datatype
→Audit logs
Enable and forward Kubernetes API audit logs
→Prometheus metrics
Scrape metrics from control plane and applications
→Splunk indexes
Split logs and metrics into separate Splunk indexes
→Metrics index
Send node, pod, container and process stats to a Splunk metrics index
→Splunk field extraction
Define search-time field extraction rules for container logs
→Common Information Model
Map nodes, the API audit and CPU vulnerabilities to CIM data models
→Splunk HTTP Event Collector
Configure SSL and connection settings for Splunk HEC
→Multiple clusters
Identify and differentiate multiple clusters in Splunk
→Object streaming
Stream live Kubernetes object changes to Splunk
→License server
Distribute license keys across clusters from a central URL
→GPU monitoring
Collect NVIDIA GPU metrics with an nvidia-smi DaemonSet
→Alert Catalog
Pick alerts from templates and scope them to clusters and namespaces
→Troubleshooting
Verify configuration, check pod status, and diagnose issues
→Release history
Changelog of Collectord and Splunk app releases
→Upgrade
Step-by-step version upgrade instructions
→Security
Image security, container privileges, and RBAC access model
→