Docs » Monitor services and hosts in Splunk Infrastructure Monitoring » Monitor Kubernetes

Monitor Kubernetes 🔗

You can monitor Kubernetes metrics with Splunk Observability Cloud. Splunk Observability Cloud uses the Splunk Distribution of OpenTelemetry Collector for Kubernetes to provide robust infrastructure monitoring capabilities. To learn more, see Get started with the Splunk Distribution of the OpenTelemetry Collector.

Prerequisites 🔗

To start monitoring Kubernetes resources, you must:

About Kubernetes navigators 🔗

Note

The following sections describe components specific to the Kubernetes navigators. For information on components shared by all navigators, see Use navigators in Splunk Infrastructure Monitoring.

On the Infrastructure landing page, you can view the summary cards for Kubernetes navigators under the Kubernetes section.

The following table describes the Kubernetes navigators:

Kubernetes navigator

Description

Use this to

  • Nodes

  • Pods

  • Containers

  • Get an overview of your Kubernetes infrastructure

  • Monitor the health of part of your Kubernetes infrastructure

  • Identify and diagnose an issue with part of your Kubernetes infrastructure

  • View services and hosts running on Kubernetes

  • Clusters

  • Workloads

  • Deployments

  • ReplicaSets

  • StatefulSets

  • DaemonSets

  • Jobs

  • CronJobs

  • Services

  • Resources

Provides a table and heat map view of Kubernetes objects across your infrastructure

  • Monitor Kubernetes instances across your infrastructure

  • Monitor a specific subset of instances, such as workloads running in a particular namespace

  • View services and hosts running on Kubernetes

Investigate instances with the hierarchy map 🔗

Note

The hierarchy map is only available on the Kubernetes nodes, pods, and containers navigators.

Monitor your Kubernetes infrastructure with an interactive hierarchical map that displays the child resources associated with a selected Kubernetes instance. You can select elements in the map to drill down into them, or use the filter to explore your data. The level of detail shown on the map is dynamic and depends on the number of elements shown.

To navigate to the hierarchy map:

  1. From the Splunk Observability Cloud main menu, select Infrastructure, then Kubernetes.

  2. Select the Kubernetes nodes, pods, or containers navigator.

  3. The table view displays by default. Select an instance from the table.

  4. Expand the Hierarchy Map.

Nodes, pods, and containers are colored by health and status, as reported by Kubernetes:

  • Nodes are colored by condition: Node Ready, Memory Pressure, PID Pressure, Disk Pressure, Network Unavailable, and Out of Disk

  • Pods are colored by phase: Running, Pending, Succeeded, Failed, and Unknown

  • Containers are colored by status: Ready, Not Ready, and Unknown

Hierarchy map features 🔗

To investigate instances with the hierarchy map, use the following features:

  • Breadcrumb navigation: Switch to different instances and jump across entity levels using the breadcrumb navigation bar.

  • Hover: Get more information about an instance, including its status or phase, by hovering over that instance.

  • Select and zoom: Drill down into an instance and change the zoom level of the map, if applicable, by selecting the instance.

  • Filter: Filter the map by any available metadata in your Kubernetes data, such as a namespace, a workload, or any other key-value pair. When you apply a filter, the map highlights instances that match the filter. You can still hover over the dimmed instances to view details about them.

Refine your view with the left navigation panel 🔗

Use the left navigation panel in the table or heat map view to quickly switch between Kubernetes entity types, search for filters, use predefined filters, and view or use recently used filters.

To refine your view with the left navigation panel, use the following features:

  • Select entity type: Use this drop-down menu to switch between Kubernetes entity types.

  • Refine by: Use this panel to search for filters, use predefined filters, or view and use recently used filters. The list of predefined filters is searchable and organized by Relationship and Attribute.

Troubleshoot performance with the analyzer 🔗

Note

The analyzer is only available on the Kubernetes nodes, pods, and containers navigators.

You can access the Kubernetes analyzer through the K8s analyzer tab. The analyzer helps you troubleshoot Kubernetes problems at scale by highlighting Kubernetes instances that are in a bad state, such as nodes that are not ready. The analyzer produces theories about what those instances might have in common, such as that all of the instances are running the same workload or all instances are located in the same AWS region. Select a finding in the analyzer to filter the map.

The analyzer displays suggested filters for the elements selected in the table or heat map view. Select links in the analyzer to add filters to the table or heat map view and explore conditions across your entire Kubernetes environment.

The analyzer uses AI-driven insights to examine potential patterns between nodes, pods, or containers. The trouble indicators are:

  • Pods that are in pending status

  • Pods that are in failed status

  • Pods with unknown condition

  • Containers with high restart counts

  • Nodes not ready

  • Nodes with unknown condition

  • Nodes experiencing high CPU

  • Nodes experiencing high memory

The analyzer displays overrepresented metrics properties for known conditions, such as pods in pending status, pods in failed status, and so on. You can use properties that are highly correlated with these conditions to filter the table or heat map. You can explore data about each of those elements in the navigator using context-sensitive dashboards. This enables you to identify the underlying patterns noticeable on the filtered map that might be correlated with Kubernetes issues. For example, if all failed pods are in certain types of clusters, the analyzer provides suggested paths to follow to troubleshoot such issues.

Next steps 🔗

You can also export and monitor data related to your Kubernetes clusters, as described in the following table.

Get data in

Monitor

Description

Connect to the cloud service provider your Kubernetes clusters run in, if any.

Instrument back-end applications to send spans to Splunk APM

Introduction to Splunk APM

Collect metrics and spans from applications running in Kubernetes clusters.

This page was last updated on Mar 11, 2025.