> ## Documentation Index
> Fetch the complete documentation index at: https://docs.honeycomb.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk (TCP)

<Badge className="hny-badge-enterprise-addon" stroke>Ent+</Badge>

<Note>
  This feature is available as an add-on for the [Honeycomb Enterprise plan](https://www.honeycomb.io/pricing/).
  Please contact your Honeycomb account team for details.
</Note>

## Supported Platforms

| Platform           | Metrics | Logs | Traces |
| :----------------- | :------ | :--- | :----- |
| Linux              |         | ✓    |        |
| Windows            |         | ✓    |        |
| macOS              |         | ✓    |        |
| Kubernetes Gateway |         | ✓    |        |

## Configuration Table

| Parameter                       | Type       | Default                  | Description                                                                                                                                                                                                                                          |
| :------------------------------ | :--------- | :----------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| listen\_ip                      | `string`   | "0.0.0.0"                | IP Address to listen on.                                                                                                                                                                                                                             |
| listen\_port\*                  | `int`      |                          | Port to listen on.                                                                                                                                                                                                                                   |
| log\_type                       | `string`   | splunk\_tcp              | Arbitrary for attribute 'log\_type'. Useful for filtering between many log sources.                                                                                                                                                                  |
| parse\_format                   | `enum`     | none                     | Method to use when parsing. Valid values are `none`, `json`, and `regex`. When regex is selected, 'Regex Pattern' must be set.                                                                                                                       |
| regex\_pattern                  | `string`   |                          | The regex pattern used when parsing log entries.                                                                                                                                                                                                     |
| multiline\_line\_start\_pattern | `string`   |                          | Regex pattern that matches the beginning of a log entry, for handling multiline logs.                                                                                                                                                                |
| multiline\_line\_end\_pattern   | `string`   |                          | Regex pattern that matches the end of a log entry, useful for terminating parsing of multiline logs.                                                                                                                                                 |
| parse\_timestamp                | `bool`     | false                    | Whether to parse the timestamp from the log entry.                                                                                                                                                                                                   |
| timestamp\_field                | `string`   | timestamp                | The field containing the timestamp in the log entry.                                                                                                                                                                                                 |
| parse\_timestamp\_format        | `enum`     | ISO8601                  | The format of the timestamp in the log entry. Choose a common format, or specify a custom format. Options include "ISO8601", "RFC3339", "Epoch", and "Manual".                                                                                       |
| epoch\_timestamp\_format        | `enum`     | s                        | The layout of the epoch-based timestamp. Required when parse\_timestamp\_format is set to "Epoch".. Options include "s", "ms", "us", "ns", "s.ms", "s.us", "s.ns".                                                                                   |
| manual\_timestamp\_format       | `string`   | '%Y-%m-%dT%H:%M:%S.%f%z' | The strptime layout of the timestamp. Used when parse\_timestamp\_format is set to "Manual".                                                                                                                                                         |
| timezone                        | `timezone` | UTC                      | The timezone to use if the Timestamp Format doesn't include a timezone. Otherwise, the timezone in the Timestamp Format will be respected. **NOTE: This is also required to parse timezone abbreviations, due to their ambiguity.**                  |
| parse\_severity                 | `bool`     | false                    | Whether to parse severity from the log entry.                                                                                                                                                                                                        |
| severity\_field                 | `string`   | severity                 | The field containing the severity in the log entry.                                                                                                                                                                                                  |
| parse\_to                       | `string`   | body                     | The [field](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/pkg/stanza/docs/types/field.md) that the log will be parsed to. Some exporters handle logs favorably when parsed to `attributes` over `body` and vice versa. |
| enable\_tls                     | `bool`     | false                    | Whether or not to use TLS.                                                                                                                                                                                                                           |
| tls\_certificate\_path          | `string`   |                          | Path to the TLS cert to use for TLS-required connections.                                                                                                                                                                                            |
| tls\_private\_key\_path         | `string`   |                          | Path to the TLS key to use for TLS-required connections.                                                                                                                                                                                             |
| tls\_min\_version               | `enum`     | "1.2"                    | The minimum TLS version to support. 1.0 and 1.1 should not be considered secure. Valid values include: `1.3`, `1.2`, `1.1`, `1.0`.                                                                                                                   |

## Kubernetes

The Splunk TCP source type supports Kubernetes Gateway agents. Splunk forwarders can send logs to
the agents using the clusterIP services.

### Prerequisites

* Honeycomb Telemetry Pipeline v1.46.0 or newer

### Configuration

Add the Splunk TCP source to your Gateway agent configuration. Set "Listen Address" to `0.0.0.0` and
Listen Port to `9997`.

The Splunk forwarders should be configured to forward telemetry to `bindplane-gateway-agent.bindplane-agent.svc.cluster.local`
on port `9997`. If the Splunk forwarders live outside of the cluster, you must make the `bindplane-gateway-agent`
service in the `bindplane-agent` namespace available using TCP ingress or by defining your own service
that can receive traffic from outside of the cluster. See the Kubernetes [service documentation](https://kubernetes.io/docs/tutorials/kubernetes-basics/expose/expose-intro/) for more information.

Below is an example Splunk forwarder outputs configuration.

```ini theme={}
[tcpout]
defaultGroup = bindplane-gateway-agent

[tcpout:bindplane-gateway-agent]
server = bindplane-gateway-agent.bindplane-agent.svc.cluster.local:9997
compressed = false
useACK = false
sendCookedData = false
```