Collect logs with the Collector for Windows

Prerequisites

• A running Splunk Enterprise or Splunk Cloud Platform deployment.

• A Splunk HTTP Event Collector (HEC) token with write access to the target index. For more information, see Use HTTP Event Collector.

• A Windows host where you can install the Splunk Distribution of OpenTelemetry Collector.

Install the Collector with log collection enabled

Pass the Splunk HEC endpoint URL, token, and target log index to the installer by using msi_public_properties.

& {
  Set-ExecutionPolicy Bypass -Scope Process -Force
  $script = (New-Object System.Net.WebClient).DownloadString('https://dl.observability.splunkcloud.com/splunk-otel-collector.ps1')

  $params = @{
    msi_public_properties = "SPLUNK_PLATFORM_URL=<URL> SPLUNK_PLATFORM_TOKEN=<TOKEN> SPLUNK_PLATFORM_LOGS_INDEX=<INDEX>"
  }
  & ([scriptblock]::Create($script)) @params
}

To also send metrics and traces to Splunk Observability Cloud, include your Splunk Observability Cloud access token and realm:

& {
  Set-ExecutionPolicy Bypass -Scope Process -Force
  $script = (New-Object System.Net.WebClient).DownloadString('https://dl.observability.splunkcloud.com/splunk-otel-collector.ps1')

  $params = @{
    access_token = "<ACCESS_TOKEN>"
    realm = "<REALM>"
    msi_public_properties = "SPLUNK_PLATFORM_URL=<URL> SPLUNK_PLATFORM_TOKEN=<TOKEN> SPLUNK_PLATFORM_LOGS_INDEX=<LOGS_INDEX>"
  }
  & ([scriptblock]::Create($script)) @params
}

Installer options

Use these MSI public properties to send Windows logs to the Splunk platform:

To avoid missing data because of index routing, set SPLUNK_PLATFORM_LOGS_INDEX or make sure the HEC token has a default index.

Collected logs

By default, the Collector tails logs from common Windows file locations, including DHCP server logs, Windows Update logs, Netlogon logs, and firewall logs. The Collector also monitors Windows Event Log channels, including Application, Security, System, ForwardedEvents, DFS Replication, Directory Service, File Replication Service, DNS Server, Key Management Service, Microsoft-Windows-PrintService/Operational, and Microsoft-Windows-Windows Defender/Operational. This behavior mirrors the Splunk Add-on for Microsoft Windows.

For the full list of included paths and receivers, see splunk_logs_config_windows.yaml.

Activate or deactivate receivers

1. Edit C:\ProgramData\Splunk\OpenTelemetry Collector\splunk_logs_config_windows.yaml and comment or uncomment receivers in the service.pipelines section:

   YAMLCopy

   service: pipelines: logs/application: receivers: [windows_event_log] processors: [transform/application, resource_detection] exporters: [splunk_hec/logs] logs/security: receivers: [windows_event_log/security] processors: [transform/security, resource_detection] exporters: [splunk_hec/logs]

   service:
     pipelines:
       logs/application:
         receivers: [windows_event_log]
         processors: [transform/application, resource_detection]
         exporters: [splunk_hec/logs]
       logs/security:
         receivers: [windows_event_log/security]
         processors: [transform/security, resource_detection]
         exporters: [splunk_hec/logs]

2. Restart the Collector service:

   POWERSHELLCopy

   Restart-Service splunk-otel-collector

   Restart-Service splunk-otel-collector

Add log files

Each file_log receiver has an include list of glob patterns. To collect logs from a custom application, add the application path to a file_log receiver:

file_log/dhcp:
  include:
    - '${env:SystemRoot}\System32\DHCP\DhcpSrvLog*'
    - '${env:SystemRoot}\SomeOtherDirectory\DHCP*.log'

To exclude files within a matched pattern, add the files to the exclude list:

file_log/firewall:
  include:
    - '${env:SystemRoot}\System32\LogFiles\Firewall\*'
  exclude:
    - '${env:SystemRoot}\System32\LogFiles\Firewall\sensitive_data.log'

For the full glob syntax and available options, see the filelog receiver documentation and the Windows Event Log receiver documentation.

Verify log ingestion

Run a search in Splunk Cloud Platform or Splunk Enterprise for events that use the default receiver source type:

index="<your-index>" sourcetype="XmlWinEventLog"

To view all source types currently being ingested, run the following search:

index="<your-index>" | stats count by sourcetype

Sizing

Log collection with the filelog receiver scales differently than metrics and traces. CPU usage depends mostly on the number of monitored files, not only total throughput.

Use the following CPU recommendations as a starting point for common file counts and per-file rates:

These values were tested with plain-text log lines and no parsing or field extraction in the Collector pipeline. In these tests, log line size was not the main driver of resource usage. Most Collector resources were spent monitoring files and processing records.

At equal events per second, more files require more CPU. The following examples show observed CPU usage from the source sizing tests:

• CPU scales approximately linearly with throughput for a similar file shape and pipeline configuration.

• Using multiple filelog receivers can reduce CPU usage at high file counts.

• For vertical scaling, Splunk HEC and the indexing tier are often the limiting factors. Size HEC and the indexing tier for the expected load so retries and backpressure don't increase Collector resource usage.

• JSON parsing, regex operators, and similar processing stages increase CPU usage above these baseline values.

Validate these starting values against your log shape, file count, and downstream capacity.