Set up the Splunk Distribution of the OpenTelemetry Collector

Reference information for setting up and verifying the Splunk Distribution of the OpenTelemetry Collector route.

Set up the Collector route that the combined agents in the migration wave use to send OpenTelemetry telemetry to Splunk Observability Cloud.

Use a local Collector for the preferred agent deployment. Add a gateway Collector when your approved design centralizes processing or reduces direct outbound connections. If the migration wave uses an approved direct-ingest design, you can skip this task.

Prerequisites

Confirm that:

  • The target host for the Collector, container platform, or Kubernetes cluster meets the current Collector requirements.
  • The target host for the Collector can reach the required Splunk realm, Splunk Observability Cloud ingest endpoint, and your Splunk Observability Cloud organization.
  • You have ingest tokens for your Splunk Observability Cloud organization.

Select a deployment option for the collector

Deployment option OpenTelemetry data path Select this route when Operational considerations

Local Collector route, also called “agent mode”

Combined agent → local Collector → Splunk Observability Cloud

Each participating host or node can run a local Splunk Distribution of the OpenTelemetry Collector. Use this route for most production deployments.

The local Collector provides a consistent location for authentication, batching, retries, processing, and export. You must deploy, monitor, and maintain a Collector on each participating host or node.

Local and gateway Collectors

Combined agent → local Collector → gateway Collector → Splunk Observability Cloud

Multiple hosts or clusters must share a controlled egress point or centralized telemetry-processing layer.

The gateway centralizes outbound connectivity and export configuration. You must size, secure, monitor, and maintain both the local Collectors and the gateway.

Direct ingest

Combined agent → Splunk Observability Cloud

The combined-agent release supports direct ingest and your security and network teams approve a direct connection from the application host.

This route requires no Collector. Each application host needs outbound connectivity and the required authentication configuration. This route provides less centralized control over processing, retry behavior, credentials, and outbound connections.

Use the same telemetry route within a deployment group when possible. Document any exceptions, and validate the complete route before expanding the deployment.

Set up the collector

  1. Install the Splunk Distribution of the OpenTelemetry Collector by using the installation method approved for your environment. See Get started with the Splunk Distribution of the OpenTelemetry Collector.

  2. Configure the Collector with the destination realm and an environment-specific ingest token. Store the token through your approved secret-management method.

  3. Configure and activate the OTLP receiver that matches the protocol configured for the combined agent. By default, the receiver uses port 4317 for OTLP over gRPC and port 4318 for OTLP over HTTP.

  4. Configure and activate the OTLP/HTTP exporter with the realm-specific Splunk Observability Cloud trace and metric ingest endpoints. Add the exporter to the applicable service pipelines and configure the approved ingest token.

    For a local Collector that forwards to a gateway instead of directly to Splunk Observability Cloud, use the OTLP exporter.

  5. If the design uses a gateway, configure the local Collector to export to the gateway and configure the gateway to export to Splunk Observability Cloud.

  6. Apply the approved resource processors, batching, retry, queue, memory, TLS, and proxy settings.

  7. Start or restart the Collector.

Verify the collector

Confirm that:

  • The Collector service runs.
  • The configured OTLP receiver listens on the expected interface and port.
  • The application hosts can reach the receiver.
  • Collector logs do not show authentication, connection, export, queue, or configuration errors.
  • The Collector can export telemetry to the destination organization on Splunk Observability Cloud.
  • Tokens and other secrets do not appear in configuration exports, logs, screenshots, or migration records.

Record the Collector endpoint and protocol for the agent owners.