Kibana events vs. Splunk events, Missing fields
Hi all,
We've enabled Splunk integration in Pega Cloud. Comparing the logs in Kibana and Splunk, I noticed Kibana's events have many extra fields than Splunk's.
For example, in prpc-alert-logs:
- In Kibana there are dozens of fields such as KPIValue, KPIThreshold, Customer, Environment, etc...
- In Splunk, the only visible data seems to be the "message" field in Kibana.
How do I get all the fields to stream to Splunk as well?
Walmart
US
Hi,
As per my experience, you need to configure the Splunk Universal Forwarder (UF) to collect data from Pega Cloud's log files To ensure that all the fields in Pega Cloud's prpc-alert-logs are streaming to Splunk.
To do this, you need to follow the steps below:
- Install the Splunk UF on the same server as the Pega Cloud instance.
- Configure the UF to monitor the prpc-alert-logs directory.
- Create a custom log input in Splunk for the prpc-alert-logs data.
- Configure the UF to send the data to the Splunk indexer.
Once the UF is configured and running, it should collect all fields in the Pega Cloud's prpc-alert-logs and send them to the Splunk indexer for indexing and analysis.
Note that if the logs are being forwarded using syslog, you may need to configure the syslog receiver to parse the logs correctly and extract all the necessary fields. This can be done using a custom syslog parser or by modifying the existing syslog configuration in Splunk.
Remember, it is important to note that you will need to ensure that the Splunk license is sufficient to accommodate the additional data volume from Pega Cloud's logs.
Hi,
As per my experience, you need to configure the Splunk Universal Forwarder (UF) to collect data from Pega Cloud's log files To ensure that all the fields in Pega Cloud's prpc-alert-logs are streaming to Splunk.
To do this, you need to follow the steps below:
- Install the Splunk UF on the same server as the Pega Cloud instance.
- Configure the UF to monitor the prpc-alert-logs directory.
- Create a custom log input in Splunk for the prpc-alert-logs data.
- Configure the UF to send the data to the Splunk indexer.
Once the UF is configured and running, it should collect all fields in the Pega Cloud's prpc-alert-logs and send them to the Splunk indexer for indexing and analysis.
Note that if the logs are being forwarded using syslog, you may need to configure the syslog receiver to parse the logs correctly and extract all the necessary fields. This can be done using a custom syslog parser or by modifying the existing syslog configuration in Splunk.
Remember, it is important to note that you will need to ensure that the Splunk license is sufficient to accommodate the additional data volume from Pega Cloud's logs.
Thanks