Docs » Get started with the Splunk Distribution of the OpenTelemetry Collector » Get started with the Collector for Windows » Install the Collector for Windows manually

Install the Collector for Windows manually πŸ”—

Before proceeding to install the Collector for Windows manually, check the prerequisites.

Modify the default configuration πŸ”—

All installation methods offer default configurations using environment variables. Before starting the splunk-otel-collector service, replace the variables in the default configuration file with the appropriate values for your environment. See Advanced configuration for Windows for more information.

Splunk-specific environment variables are listed on the table below:

Name

Description

Default config?

SPLUNK_ACCESS_TOKEN

The Splunk access token to authenticate requests

Yes

SPLUNK_API_URL

The Splunk API URL. For example, https://api.us0.signalfx.com

Yes

SPLUNK_BALLAST_SIZE_MIB

Use it to set the ballast size for the Collector explicitly instead of the value calculated from SPLUNK_MEMORY_LIMIT_MIB. Set it to 1/3 to 1/2 of the configured memory

No

SPLUNK_BUNDLE_DIR

The path to the Smart Agent bundle. For example, /usr/lib/splunk-otel-collector/agent-bundle

Yes

SPLUNK_COLLECTD_DIR

The path to the collectd config directory for the Smart Agent. For example, /usr/lib/splunk-otel-collector/agent-bundle/run/collectd

Yes

SPLUNK_CONFIG

Destination path of the Collector custom configuration file

No

SPLUNK_CONFIG_YAML

Specifies your custom configuration YAML. This is useful in environments where access to the underlying file system is not readily available

No

SPLUNK_DEBUG_CONFIG_SERVER

By default, the Collector provides a sensitive value-redacting, local config server listening at http://localhost:55554/debug/configz/effective, which is helpful in troubleshooting. To disable it, set SPLUNK_DEBUG_CONFIG_SERVER to any value other than true. To set the desired port to listen to, use SPLUNK_DEBUG_CONFIG_SERVER_PORT

No

SPLUNK_HEC_TOKEN

The Splunk HEC authentication token

Yes

SPLUNK_HEC_URL

The Splunk HEC endpoint URL. For example, https://ingest.us0.signalfx.com/v1/log

Yes

SPLUNK_INGEST_URL

The Splunk ingest URL. For example, https://ingest.us0.signalfx.com

Yes

SPLUNK_LISTEN_INTERFACE

The network interface the agent receivers listen on. 0.0.0.0 by default

Yes

SPLUNK_MEMORY_LIMIT_MIB

Use it to set the memory limit for the memory_limiter processor. 512 MiB by default

No

SPLUNK_MEMORY_TOTAL_MIB

Total memory in MiB to allocate to the Collector

No

SPLUNK_REALM

Your Splunk realm

No

SPLUNK_TRACE_URL

The Splunk trace endpoint URL. For example, https://ingest.us0.signalfx.com/v2/trace

Yes

SPLUNK_*_URL environment variables are automatically derived from SPLUNK_REALM. For example, SPLUNK_INGEST_URL = https://ingest.SPLUNK_REALM.signalfx.com.

Configure proxy settings πŸ”—

To configure proxy settings to install and run the OpenTelemetry Collector, see Configure proxy settings for the Collector.

Windows installer file (MSI) installation πŸ”—

To install the package using Windows Installer, download the Windows MSI package (64-bit only) from GitHub releases .

  • The package is installed to \Program Files\Splunk\OpenTelemetry Collector.

  • The splunk-otel-collector service is created, but not started.

  • A default configuration file is copied to \ProgramData\Splunk\OpenTelemetry Collector\agent_config.yaml, if it does not already exist. This file is required to start the splunk-otel-collector service.

Note

The ProgramData folder is hidden by default on Windows.

Next, proceed with the GUI, or follow the instructions to install using a Powershell terminal.

Install using the GUI πŸ”—

Run the downloaded package and follow the instructions in the guided setup.

Install using a PowerShell terminal πŸ”—

Follow these steps:

  1. Open a PowerShell terminal.

  2. Run the following command, where PATH_TO_MSI is the full path to the downloaded package. For example, C:\your\download\folder\splunk-otel-collector-0.4.0-amd64.msi.

Start-Process -Wait msiexec "/i PATH_TO_MSI /qn"
  1. Update all variables in the configuration file as appropriate.

  2. Start the splunk-otel-collector service by rebooting the system or by running the following command in a PowerShell terminal:

Start-Service splunk-otel-collector

Learn more about advanced configuration options (including Service Logging) using PowerShell in the Splunk Distribution of OpenTelemetry Collector Windows manual .

Install Fluentd MSI for log collection πŸ”—

Default log collection πŸ”—

Install, configure, and start the Collector with Windows Installer. The Collector default configuration file \ProgramData\Splunk\OpenTelemetry Collector\agent_config.yaml listens for log events on 127.0.0.1:8006 and sends them to Splunk Observability Cloud.

Log collection with Fluentd πŸ”—

Note

You need to be an Admin to configure log collection with Fluentd.

Perform the following steps to install Fluentd and forward collected log events to the Collector:

  1. Install Fluentd MSI version 4.0 or higher.

  2. Configure Fluentd to collect log events and forward them to the Collector:

    • Option 1: Update the default config file provided by the Fluentd MSI at \opt\td-agent\etc\td-agent\td-agent.conf to collect the desired log events and forward them to 127.0.0.1:8006.

    • Option 2: The installed Collector package provides a custom Fluentd config file \Program Files\Splunk\OpenTelemetry Collector\fluentd\td-agent.conf to collect log events from the Windows Event Log \Program Files\Splunk\OpenTelemetry Collector\fluentd\conf.d\eventlog.conf and forwards them to 127.0.0.1:8006.

    To use these files, backup the \opt\td-agent\etc\td-agent` directory, and copy the contents from \Program Files\Splunk\OpenTelemetry Collector\fluentd` to \opt\td-agent\etc\td-agent`.

  3. To apply any changes made to the Fluentd config files, restart the system, or restart fluentdwinsvc .

- Stop-Service fluentdwinsvc
- Start-Service fluentdwinsvc
  1. View the Fluentd service logs and errors in \opt\td-agent\td-agent.log.

Learn more about general Fluentd configuration details in the official Fluentd documentation .

Install using a Chocolatey package πŸ”—

A Chocolatey package is available to download, install, and configure the Collector and Fluentd with the following PowerShell command:

choco install splunk-otel-collector --params="'/SPLUNK_ACCESS_TOKEN:MY_SPLUNK_ACCESS_TOKEN /SPLUNK_REALM:MY_SPLUNK_REALM'"

Learn more about the package parameters in GitHub.

Install using Docker πŸ”—

Run the following command to deploy the latest Docker image:

$ docker run --rm -e SPLUNK_ACCESS_TOKEN=12345 -e SPLUNK_REALM=us0  `
          -p 13133:13133 -p 14250:14250 -p 14268:14268 -p 4317:4317 -p 6060:6060  `
          -p 8888:8888 -p 9080:9080 -p 9411:9411 -p 9943:9943 `
          --name=otelcol quay.io/signalfx/splunk-otel-collector-windows:latest

Install using the binary file πŸ”—

To install the Collector using the binary file, follow these steps:

  1. Download the binary for your architecture from GitHub releases .

  2. If you’re not using an existing or custom config file, download the default config file <https://github.com/signalfx/splunk-otel-collector/tree/main/cmd/otelcol/config/collector>` for the Collector. See more at Collector for Windows default configuration.

  3. Run the binary from the command line:

# see available command-line options
PS> & '<download dir>\otelcol_windows_amd64.exe' --help
Usage of otelcol:
    --config string          Locations to the config file(s), note that only a single location can be set per flag entry e.g. --config=/path/to/first --config=path/to/second. (default "[]")
    --feature-gates string   Comma-delimited list of feature gate identifiers. Prefix with '-' to disable the feature. '+' or no prefix will enable the feature. (default "[]")
    --no-convert-config      Do not translate old configurations to the new format automatically. By default, old configurations are translated to the new format for backward compatibility.
    --set string             Set arbitrary component config property. The component has to be defined in the config file and the flag has a higher precedence. Array config properties are overridden and maps are joined. Example --set=processors.batch.timeout=2s (default "[]")
    -v, --version                Version of the collector.

# set the SPLUNK_REALM and SPLUNK_ACCESS_TOKEN env vars required in our default config files
PS> $env:SPLUNK_REALM = "<realm>"
PS> $env:SPLUNK_ACCESS_TOKEN = "<token>"

# start the collector
PS> & '<download dir>\otelcol_windows_amd64.exe' --config=<path to config file>

# alternatively, use the SPLUNK_CONFIG env var instead of the --config command-line option
PS> $env:SPLUNK_CONFIG = "<path to config file>"
PS> & '<download dir>\otelcol_windows_amd64.exe'

# type Ctrl-c to stop the collector

Use a custom configuration file πŸ”—

If you’re using a custom configuration file, mount the directory containing the file and either use the SPLUNK_CONFIG=<path> environment variable or the --config=<path> command line argument. Replace <path> with the path to the custom file within the container.

To mount configuration files on a Windows container, specify a directory name in which the configuration file is present.

Example with SPLUNK_CONFIG πŸ”—

$ docker run --rm -e SPLUNK_ACCESS_TOKEN=12345 -e SPLUNK_REALM=us0 `
          -e SPLUNK_CONFIG=c:\splunk_config\gateway_config.yaml -p 13133:13133  `
          -p 14250:14250 -p 14268:14268 -p 4317:4317 -p 6060:6060 -p 8888:8888 -p 9080:9080 `
          -p 9411:9411 -p 9943:9943 -v ${PWD}\splunk_config:c:\splunk_config:RO `
          --name otelcol quay.io/signalfx/splunk-otel-collector-windows:latest

Example with --config πŸ”—

$ docker run --rm -e SPLUNK_ACCESS_TOKEN=12345 -e SPLUNK_REALM=us0 `
    -p 13133:13133 -p 14250:14250 -p 14268:14268 -p 4317:4317 -p 6060:6060 `
    -p 8888:8888 -p 9080:9080 -p 9411:9411 -p 9943:9943 `
    -v ${PWD}\splunk_config:c:\splunk_config:RO `
    --name otelcol quay.io/signalfx/splunk-otel-collector-windows:latest `
    --config c:\splunk_config\gateway_config.yaml

Next steps πŸ”—

Once you have installed the package, you can perform these actions: