Architecture Overview

The Splunk Firehose Nozzle for VMware Tanzu is a VMware Tanzu Application Service for virtual machines (VMs) app. The nozzle subscribes to the Loggregator endpoint and writes events to an external Splunk platform environment.

Inside each nozzle is the following:

• A Golang routine collects events from the Loggregator endpoint using v1 api.
• An in-memory queue buffers events for availability to multiple Splunk HTTP Event Collector clients.
• The Splunk HTTP Event Collector clients run with their own Golang routines that consume events from the queue to enrich VMware Tanzu events by attaching metadata fields.
• Finally, the events are batched together and sent to Splunk via the HEC endpoint.