Splunk Connect for Kafka
Splunk Built
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
Splunk Connect for Kafka is a sink connector that allows a Splunk software administrator to subscribe to a Kafka topic and stream the data to the Splunk HTTP event collector. Built on top of the Kafka Connect library, this connector provides:
- High scalability, allowing linear scaling, limited only by the hardware supplied to the Kafka Connect environment.
- High reliability, by ensuring at-least-once delivery of data.
- Ease of data onboarding and simple configuration with Kafka Connect framework and Splunk's HTTP event collector.
- Support for ingestion of Kafka Record headers.
This product supports Splunk platform environments versions 7.1 and later.
Click Visit Site to download the latest release from the Splunk GitHub repository
- High scalability, allowing linear scaling, limited only by the hardware supplied to the Kafka Connect environment.
- High reliability, by ensuring at-least-once delivery of data.
- Ease of data onboarding and simple configuration with Kafka Connect framework and Splunk's HTTP event collector.
- Support for ingestion of Kafka Record headers.
This product supports Splunk platform environments versions 7.1 and later.
Click Visit Site to download the latest release from the Splunk GitHub repository
For more information please visit the Splunk Connect for Kafka user documentation.
Configurable features include:
- Load Balancing by specifying list of indexers, or using a load balancer
- Indexer Acknowledgements for guaranteed at-least-once delivery
- Support for ingestion of Kafka Connect record headers
- Support for using Kafka Connect record headers as Splunk HEC metadata values (index, host, source, sourcetype)
- Index routing capibility at the global, per topic and per event level
-
Version 2.0.0 of Splunk Connect for Kafka contains the following new features:
- Configurable flush window. Users can now set a flush rate depending on their data-rate and event frequency.
- Clear Record Tracker (internal memory buffer) on acknowledgments to reduce memory footprint.
- Polling for Indexer fault tolerance.
- Improved ability to handle Null/Empty events.
- Improved efficiency on memory utilization and flushing of events from memory for situations when
ACKis not enabled in the Splunk software. - Ability to track HTTP Event Collector (HEC) telemetry.