Splunk Observability Cloud architecture 🔗
Splunk Observability Cloud is built on top of OpenTelemetry and uses it as the default way of getting data in, which gives you an open standards-based set of instrumentation across all your data types. With Log Observer Connect, you can also query your Splunk Enterprise or Splunk Cloud Platform logs using the capabilities in Splunk Observability Cloud, giving you an overview of all your data in one place.
%%{
init: {
'theme': 'base',
'themeVariables': {
'primaryColor': '#FFFFFF',
'primaryTextColor': '#000000',
'primaryBorderColor': '#000000',
'nodeBorder':'#000000',
'lineColor': '#000000',
'fontSize': '22px',
}
}
}%%
flowchart LR
accTitle: Splunk Observability Cloud architecture diagram
accDescr: Splunk Observability Cloud architecture can be broken down into 4 main components, data collection, data ingestion, data procesisng and retention, and analytics. Splunk Observability Cloud uses OpenTelemetry as the default method of data collection, which gives you a single set of instrumentation across different data types, such as distributed traces and metrics. You can also send Splunk Enterprise or Splunk Cloud Platform logs to Splunk Observability Cloud with the use of Log Observer Connect. Once you get your data in, OpenTelemetry Collector can aggregate, parse, extract, enrich, or delete your data as needed. The underlying mechanism for data ingestion is the Quantizer, which offers rollups and dynamic lag adjustment. Trace assembly and metadata extraction are also parts of data ingestion. Data processing and retention includes trace indexing and storage, trace metricization, as well as metrics routing and storage. Lastly, Splunk Observability Cloud offers various analytics tools for your data, including but not limited to, tracing analysis, predictive analysis, incident analysis, anomaly detection, SignalFlow, and historical baselines.
%% LR indicates the direction (left-to-right)
classDef default fill:#FFFFFF, stroke:#000
classDef platform fill:#acd1a4, stroke:#000
classDef loc fill:#fdf8a4, stroke:#000
classDef dataColor fill:#d9d9d9, stroke:#000
classDef otelColor fill:#afcedb, stroke:#000
classDef ingestionColor fill:#fbc477, stroke:#000
classDef processingColor fill:#fab9b4, stroke:#000
classDef analyticsColor fill:#f999cb, stroke:#000
log-->splunkPlatform[(Splunk platform)]:::platform-->logObserver[(Log Observer Connect)]:::loc-->analytics
subgraph o11yArchitecture[          Splunk Observability Cloud Architecture]
direction LR
data-->otel-->ingestion
ingestion-->processingRetention-->analytics
class data dataColor
subgraph data[Data sources]
direction LR
log(Logs)
disTrace(Distributed traces)
metric(Metrics)
end
class otel otelColor
subgraph otel[OpenTelemetry Collector]
direction LR
aggregate((aggregate))
parse((parse, extract, enrich))
delete((delete))
end
class ingestion ingestionColor
subgraph ingestion[Ingestion]
direction LR
traceAssembly(Trace assembly)
quantizer(Quantizer)---rollups(Rollups)
quantizer---lagAdjust(Dynamic lag adjustment)
metadataExtraction(Metadata extraction)
end
class processingRetention processingColor
subgraph processingRetention[Processing and retention]
direction LR
indexStorage(Trace indexing and storage)
traceMetricization(Trace metricization)
metricsManagement(Metrics routing and storage)
end
class analytics analyticsColor
subgraph analytics[Analytics]
direction LR
traceAnalyis(Tracing analysis)
predictiveAnalysis(Predictive analytics)
incidentAnalysis(Incident analysis)
anommalyDetection(Anomaly detection)
signalflow(SignalFlow)
historicalBaseline(Historical baselines)
end
end