Set a default Splunk Enterprise instance for the Send to a Splunk Index (Default for Environment) function

You can set a default Splunk Enterprise or Splunk Cloud Platform instance for the Send to a Splunk Index (Default for Environment) function to send data to.

Best practices are to use the Send to a Splunk Index with Batching function instead.

Steps

1. From a node in your deployment cluster, type the following.

   ./set-config K8S_PIPELINES_DATA_SPLUNKD_HEC_HOST https://<your-splunk-enterprise-hostname>
   ./set-config K8S_PIPELINES_DATA_SPLUNKD_HEC_PORT 8088   
   ./set-config K8S_PIPELINES_DATA_SPLUNKD_INDEX main
   ./set-config K8S_PIPELINES_DATA_SPLUNKD_HEC_TOKEN <HEC token to write to the index>
   

2. After setting the configurations, deploy your changes.

   ./deploy