Docs » Connect to your cloud service provider » Connect to Google Cloud Platform » Ingest Google Cloud Platform log data

Ingest Google Cloud Platform log data 🔗

Caution

Splunk Log Observer is no longer available for new users. You can continue to use Log Observer if you already have an entitlement.

To send GCP logging data to Splunk Observability Cloud’s Log Observer, create a Pub/Sub subscription and use the Pub/Sub to Splunk Dataflow template to create a Dataflow job. The Dataflow job takes messages from the Pub/Sub subscription, converts payloads into Splunk HTTP Event Collector (HEC) event format, and forwards them to Splunk Observability Cloud, where the whole event (JSON payload and its information) is ingested.

Splunk Observability Cloud only supports push-based GCP log export. To learn more, see Scenarios for exporting Cloud Logging data: Splunk .

Ingest logs from GCP 🔗

To send GCP logs to Splunk Observability Cloud:

  1. Use the example gcloud command provided in Option A: Stream logs using Pub/Sub to Splunk Dataflow .

  2. Apply the with the following changes:

    • Change the token in the sample syntax (token=your-splunk-hec-token) to a Splunk Observability Cloud organization access token with ingest permission. For more information about organization access tokens, see Create and manage organization access tokens using Splunk Observability Cloud.

    • Change the URL in the sample syntax (url=your-splunk-hec-url) to point to the real-time log data ingest endpoint for Splunk Observability Cloud: https://ingest.{REALM}.signalfx.com. For example, https://ingest.{REALM}.signalfx.com:443.

Manage delivery failures 🔗

Any response code that is not 2xx, including throttling, indicates a message delivery failure.

If message delivery fails, see how to handle delivery failures of log exports to Splunk using Dataflow at GCP documentation .