# Splunk Sink Connector for Confluent Cloud The fully managed Splunk Sink connector for Confluent Cloud moves messages from Apache Kafka® to Splunk using the [Splunk HTTP Event Collector (HEC)](https://dev.splunk.com/enterprise/docs/devtools/httpeventcollector). #### NOTE * This Quick Start is for the fully managed Confluent Cloud connector. If you are installing the connector locally for Confluent Platform, see [Splunk Sink Connector for Confluent Platform](https://docs.confluent.io/kafka-connectors/splunk-sink/current/). * If you require private networking for fully managed connectors, make sure to set up the proper networking beforehand. For more information, see [Manage Networking for Confluent Cloud Connectors](networking/internet-resource.md#clusters-connect-cloud). ## Features The Splunk Sink connector supports the following features: * **At least once delivery**: This connector guarantees that records from the Kafka topic are delivered at least once. * **Supports multiple tasks**: The connector supports running one or more tasks. More tasks may improve performance (that is, consumer lag is reduced with multiple tasks running). For more information and examples to use with the Confluent Cloud API for Connect, see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section. ## Limitations Be sure to review the following information. * For connector limitations, see [Splunk Sink Connector](limits.md#cc-splunk-sink-limits) limitations. * If you plan to use one or more Single Message Transformations (SMTs), see [SMT Limitations](single-message-transforms.md#cc-single-message-transforms-limitations). ## Quick Start Use this quick start to get up and running with the Confluent Cloud Splunk Sink connector. The quick start provides the basics of selecting the connector and configuring it to stream events to Splunk. Prerequisites : - Authorized access to a [Confluent Cloud](https://www.confluent.io/confluent-cloud/) cluster on Amazon Web Services (AWS), Microsoft Azure (Azure), or Google Cloud. - The Confluent CLI installed and configured for the cluster. See [Install the Confluent CLI](https://docs.confluent.io/confluent-cli/current/install.html). - Authorized access to Splunk. - [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) must be enabled to use a Schema Registry-based format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). - At least one source Kafka topic must exist in your Confluent Cloud cluster before creating the sink connector. ### Using the Confluent Cloud Console #### Step 1: Launch your Confluent Cloud cluster To create and launch a Kafka cluster in Confluent Cloud, see [Create a kafka cluster in Confluent Cloud](../get-started/index.md#cloud-create-kafka-cluster). #### Step 2: Add a connector In the left navigation menu, click **Connectors**. If you already have connectors in your cluster, click **+ Add connector**. #### Step 3: Select your connector Click the **Splunk Sink** connector card. ![Splunk Sink Connector Card](images/ccloud-splunk-sink-icon.png) #### Step 4: Enter the connector details #### NOTE * Make sure you have all your [prerequisites](#cc-splunk-sink-prereqs) completed. * An asterisk ( \* ) designates a required entry. * Descriptions for optional UI properties are not provided in the following steps. See [Configuration Properties](#cc-splunk-sink-config-properties) for configuration property values and descriptions. At the **Add Splunk Sink Connector** screen, complete the following: ### Topic selection If you’ve already populated your Kafka topics, select the topics you want to connect from the **Topics** list. To create a new topic, click **+Add new topic**. ### Kafka access 1. Select the way you want to provide **Kafka Cluster credentials**. You can choose one of the following options: - **My account**: This setting allows your connector to globally access everything that you have access to. With a user account, the connector uses an API key and secret to access the Kafka cluster. This option is not recommended for production. - **Service account**: This setting limits the access for your connector by using a [service account](service-account.md#s3-cloud-service-account). This option is recommended for production. - **Use an existing API key**: This setting allows you to specify an API key and a secret pair. You can use an existing pair or create a new one. This method is not recommended for production environments. #### NOTE Freight clusters support only service accounts for Kafka authentication. 2. Click **Continue**. ### Authentication 1. Configure the authentication properties: - **Splunk HEC URIs**: Enter your Splunk HEC URIs-a comma-separated list of FQDNs or IP addresses for all Splunk indexers, or add a [load balancer](https://docs.splunk.com/Splexicon:Loadbalancing). For Splunk indexers, load balancing uses round-robin scheduling. Example: `https://hec1.splunk.com:8088,https://hec2.splunk.com:8088,https://hec3.splunk.com:8088`. - **Splunk HEC Token**: Enter your Splunk HEC Token-the Splunk [HTTP Event Collector token](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#How_the_Splunk_platform_uses_HTTP_Event_Collector_tokens_to_get_data_in). - **Splunk HEC SSL Validate Certificates**: For plunk HEC SSL Validate Certificates, select ``true`` or ``false``, whether to enable or disable HTTPS certification validation. - **Splunk HEC SSL Trust Store**: Upload your Splunk HEC SSL Trust Store file, which is the certificate trust store containing the certificates required to validate the SSL connection. - **Splunk HEC SSL Trust Store Password**: Enter your plunk HEC SSL Trust Store Password for the certificate trust store. 2. Click **Continue**. ### Configuration #### NOTE Configuration properties that are not shown in the Cloud Console use the default values. See [Configuration Properties](#cc-splunk-sink-config-properties) for all property values and definitions. - **Input Kafka record value format**: Select an input Kafka record value format (data coming from the Kafka topic). Valid values are AVRO, PROTOBUF, JSON_SR (JSON Schema), JSON (schemaless), or STRING. A valid schema must be available in [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) to use a schema-based message format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). ### **Show advanced configurations** - **Schema context**: Select a schema context to use for this connector, if using a schema-based data format. This property defaults to the **Default** context, which configures the connector to use the default schema set up for Schema Registry in your Confluent Cloud environment. A schema context allows you to use separate schemas (like schema sub-registries) tied to topics in different Kafka clusters that share the same Schema Registry environment. For example, if you select a non-default context, a **Source** connector uses only that schema context to register a schema and a **Sink** connector uses only that schema context to read from. For more information about setting up a schema context, see [What are schema contexts and when should you use them?](../sr/faqs-cc.md#faq-schema-contexts). - **Splunk Indexes**: Splunk index names for Kafka topic data separated by comma for multiple topics to indexers. - **Splunk Sourcetypes**: Splunk event sourcetype metadata for Kafka topic data. - **Splunk Sources**: Splunk event source metadata for Kafka topic data. - **Splunk HEC Raw**: When set to ``true``, the connector ingests data using the `/raw` HEC endpoint. - **Splunk HEC Raw Line Breaker**: Only applicable to `/raw` HEC endpoint. The setting is used to specify a custom line breaker to help Splunk separate the events correctly. - **Splunk HEC JSON Event Enrichment**: Only applicable to `/event` HEC endpoint. This setting is used to enrich raw data with extra metadata fields. It contains a list of key value pairs separated by `\",\"."`. - **Splunk HEC Track Data**: Only applicable to `/event` HEC endpoint. When set to ``true``, data loss and data injection latency metadata will be indexed along with raw data. - **Splunk HEC HTTP Keep-alive**: Enables or disables HTTP connection keep-alive. - **Splunk HEC Max HTTP Connections Per Channel**: Max HTTP connections pooled for one HEC Channel when posting events to Splunk. - **Splunk HEC Total Channels**: Total HEC Channels used to post events to Splunk. - **Splunk HEC Socket Timeout (s)**: Max duration in seconds to read or write data to network before internal TCP Socket timeout. - **Splunk HEC Use Record Timestamp**: When set to ``true``, The timestamp is retrieved from the Kafka record and passed to Splunk as a HEC metadata override. - **Splunk HEC Threads**: The number of threads spawned to do data injection via HEC in a single connector task. - **Splunk HEC Max Outstanding Events**: Maximum amount of unacknowledged events kept in memory by the connector. The connector triggers a back-pressure event to slow collection if unacknowledged events reach the maximum amount. - **Splunk HEC Max Retries**: Number of retries for failed batches before giving up. By default this is set to -1 which will retry indefinitely. - **Splunk HEC Backoff Threshold (s)**: The amount of time the connector waits on errors sending events to Splunk to attempt resending it. - **Splunk HEC JSON Event Formatted**: Set to ``true`` for events that are already in HEC format. - **Splunk HEC Max Batch Size**: Maximum batch size when posting events to Splunk. The size is the actual number of Kafka events not the byte size. - **Splunk HEC Load Balancer Poll Interval (s)**: This setting controls the load balancer polling interval. - **Splunk Flush Window (s)**: The interval in seconds at which the events from Kafka will be flushed to Splunk. - **Splunk HEC Ack Enabled**: When set to ``true`` the connector will poll event ACKs for POST events before check-pointing the Kafka offsets. This is used to prevent data loss, as this setting implements guaranteed delivery. - **Splunk HEC Ack Poll Interval (s)**: This setting is only applicable when `splunk.hec.ack.enabled` is set to ``true``. Internally it controls the event ACKs polling interval. - **Splunk HEC Ack Poll Threads**: This setting is only applicable when `splunk.hec.ack.enabled` is set to ``true``. It controls how many threads should be spawned to poll event ACKs. - **Splunk HEC Event Timeout (s)**: This setting is only applicable when `splunk.hec.ack.enabled` is set to ``true``. When events are POSTed to Splunk and before they are ACKed, this setting determines how long the connector will wait before timing out and resending. - **Splunk Header Support**: When set to ``true`` the connector will parse Kafka headers for use as metadata in Splunk events. - **Splunk Header Custom**: This setting will look for Kafka record headers with these values and add them to each event if present. Custom headers are configured separated by comma for multiple headers. - **Splunk Header Index**: Header to use for Splunk Header Index. - **Splunk Header Source**: Header to use for Splunk Header Source. - **Splunk Header Sourcetype**: Header to use for Splunk Header Sourcetype. - **Splunk Header Host**: Header to use for Splunk Header Host. **Auto-restart policy** - **Enable Connector Auto-restart**: Enables the auto-restart behavior of the connector and its task in the event of user-actionable errors. Defaults to `true`, enabling the connector to automatically restart in case of user-actionable errors. Set this property to `false` to disable auto-restart for failed connectors. If disabled, you must manually restart the connector. **Additional Configs** - **Value Converter Schema ID Deserializer**: Sets the class name of the schema ID deserializer for values. The deserializer reads schema IDs from message headers. - **Value Converter Reference Subject Name Strategy**: Sets the subject reference name strategy for values. Valid entries are `DefaultReferenceSubjectNameStrategy` or `QualifiedReferenceSubjectNameStrategy`. You can use this strategy only with `PROTOBUF` format; the default strategy is `DefaultReferenceSubjectNameStrategy`. - **Schema ID For Value Converter**: Sets the schema ID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema ID for deserializing message values. This property is applicable only when `value.converter.value.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`. - **Key Converter Schema ID Deserializer**: Sets the class name of the schema ID deserializer for keys. The deserializer reads schema IDs from message headers. - **Value Converter Decimal Format**: Specifies the `JSON` or `JSON_SR` serialization format for Connect `DECIMAL` logical type values with two allowed literals: `BASE64` to serialize `DECIMAL` logical types as base64 encoded binary data, and `NUMERIC` to serialize `DECIMAL` logical type values in `JSON` or `JSON_SR` as a number representing the decimal value. - **Schema GUID For Key Converter**: Sets the schema GUID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema GUID for deserializing message keys. This property is applicable only when `key.converter.key.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`. - **Schema GUID For Value Converter**: Sets the schema GUID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema GUID for deserializing message values. This property is applicable only when `value.converter.value.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`. - **Value Converter Connect Meta Data**: Enables the Connect converter to add its metadata to the output schema. Applies to Avro converters. - **Value Converter Value Subject Name Strategy**: Determines how to construct the subject name under which the value schema is registered with Schema Registry. - **Key Converter Key Subject Name Strategy**: Determines how to construct the subject name for key schema registration. - **Schema ID For Key Converter**: Sets the schema ID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema ID for deserializing message keys. This property is applicable only when `key.converter.key.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`. **Consumer configuration** - **Max poll interval(ms)**: Sets the maximum delay between subsequent consume requests to Kafka. Use this property to improve connector performance in cases when the connector cannot send records to the sink system. The default is 300,000 milliseconds (5 minutes). - **Max poll records**: Sets the maximum number of records to consume from Kafka in a single request. Use this property to improve connector performance in cases when the connector cannot send records to the sink system. The default is 500 records. **Transforms** - **Single Message Transformations**: To add a new SMT, see [Add transforms](single-message-transforms.md#cc-single-message-transforms-ui). For more information about unsupported SMTs, see [Unsupported transformations](single-message-transforms.md#cc-single-message-transforms-unsupported-transforms). **Processing position** - **Set offsets**: Click **Set offsets** to define a specific offset for this connector to begin procession data from. For more information on managing offsets, see [Manage offsets](offsets.md#connect-custom-offsets). See [Configuration Properties](#cc-splunk-sink-config-properties) for all property values and definitions. - Click **Continue**. ### Sizing Based on the number of topic partitions you select, you will be provided with a recommended number of tasks. 1. To change the number of recommended tasks, enter the number of [tasks](/platform/current/connect/concepts.html#tasks) for the connector to use in the **Tasks** field. 2. Click **Continue**. ### Review and Launch 1. Verify the connection details. 2. Click **Launch**. The status for the connector should go from **Provisioning** to **Running**. #### Step 5: Check for records Verify that records are being produced at Splunk. For more information and examples to use with the Confluent Cloud API for Connect, see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section. ### Using the Confluent CLI To set up and run the connector using the Confluent CLI, complete the following steps. #### NOTE Make sure you have all your [prerequisites](#cc-splunk-sink-prereqs) completed. #### Step 1: List the available connectors Enter the following command to list available connectors: ```none confluent connect plugin list ``` #### Step 2: List the connector configuration properties Enter the following command to show the connector configuration properties: ```none confluent connect plugin describe ``` The command output shows the required and optional configuration properties. #### Step 3: Create the connector configuration file Create a JSON file that contains the connector configuration properties. The following example shows the required connector properties. ```json { "connector.class": "SplunkSink", "topics": "orders", "name": "SplunkSinkConnector_0", "input.data.format": "AVRO", "kafka.auth.mode": "KAFKA_API_KEY", "kafka.api.key": "", "kafka.api.secret": "", "splunk.hec.uri": "https://hec1.splunk.com:8088,https://hec2.splunk.com:8088,https://hec3.splunk.com:8088", "splunk.hec.token": "", "tasks.max": "1", } ``` Note the following property definitions: * `"connector.class"`: Identifies the connector plugin name. * `"input.data.format"`: Sets the input Kafka record value format (data coming from the Kafka topic). Valid entries are **AVRO**, **JSON_SR**, **PROTOBUF**, **JSON**, or **STRING**. You must have Confluent Cloud Schema Registry configured if using a schema-based message format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). * `"name"`: Sets a name for your new connector. * `"kafka.auth.mode"`: Identifies the connector authentication mode you want to use. There are two options: `SERVICE_ACCOUNT` or `KAFKA_API_KEY` (the default). To use an API key and secret, specify the configuration properties `kafka.api.key` and `kafka.api.secret`, as shown in the example configuration (above). To use a [service account](service-account.md#s3-cloud-service-account), specify the **Resource ID** in the property `kafka.service.account.id=`. To list the available service account resource IDs, use the following command: ```bash confluent iam service-account list ``` For example: ```bash confluent iam service-account list Id | Resource ID | Name | Description +---------+-------------+-------------------+------------------- 123456 | sa-l1r23m | sa-1 | Service account 1 789101 | sa-l4d56p | sa-2 | Service account 2 ``` * `"splunk.hec.uri"`: Add a comma-separated list of FQDNs or IP addresses for all Splunk indexers, or add a [load balancer](https://docs.splunk.com/Splexicon:Loadbalancing). For Splunk indexers, load balancing uses round-robin scheduling. Example: `https://hec1.splunk.com:8088,https://hec2.splunk.com:8088,https://hec3.splunk.com:8088`. * `"splunk.hec.token"`: Add the Splunk [HTTP Event Collector token](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#How_the_Splunk_platform_uses_HTTP_Event_Collector_tokens_to_get_data_in). * `"tasks.max"`: Enter the maximum number of [tasks](/platform/current/connect/concepts.html#tasks) for the connector to use. More tasks may improve performance. * `"topics"`: Enter the topic name or a comma-separated list of topic names. **SMTs**: For details about adding SMTs using the Confluent CLI, see the [Single Message Transformations](single-message-transforms.md#cc-single-message-transforms) documentation. See [Configuration Properties](#cc-splunk-sink-config-properties) for all property values and descriptions. #### Step 3: Load the properties file and create the connector Enter the following command to load the configuration and start the connector: ```none confluent connect cluster create --config-file .json ``` For example: ```none confluent connect cluster create --config-file splunk-sink-config.json ``` Example output: ```none Created connector SplunkSinkConnector_0 lcc-do6vzd ``` #### Step 4: Check the connector status. Enter the following command to check the connector status: ```none confluent connect cluster list ``` Example output: ```none ID | Name | Status | Type | Trace +------------+---------------------------------+---------+------+-------+ lcc-do6vzd | SplunkSinkConnector_0 | RUNNING | sink | | ``` #### Step 5: Check for records Verify that records are populating Splunk. For more information and examples to use with the Confluent Cloud API for Connect, see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section. ## Configuration Properties Use the following configuration properties with the fully managed connector. For self-managed connector property definitions and other details, see the connector docs in [Self-managed connectors for Confluent Platform](/platform/current/connect/kafka_connectors.html). ### Which topics do you want to get data from? `topics.regex` : A regular expression that matches the names of the topics to consume from. This is useful when you want to consume from multiple topics that match a certain pattern without having to list them all individually.
* Type: string * Importance: low `topics` : Identifies the topic name or a comma-separated list of topic names.
* Type: list * Importance: high ### Schema Config `schema.context.name` : Add a schema context name. A schema context represents an independent scope in Schema Registry. It is a separate sub-schema tied to topics in different Kafka clusters that share the same Schema Registry instance. If not used, the connector uses the default schema configured for Schema Registry in your Confluent Cloud environment.
* Type: string * Default: default * Importance: medium ### Input messages `input.data.format` : Sets the input Kafka record value format. Valid entries are AVRO, JSON, JSON_SR, PROTOBUF, or STRING. Note that you need to have Confluent Cloud Schema Registry configured if using a schema-based message format like AVRO, JSON_SR, and PROTOBUF.
* Type: string * Importance: high ### How should we connect to your data? `name` : Sets a name for your connector.
* Type: string * Valid Values: A string at most 64 characters long * Importance: high ### Kafka Cluster credentials `kafka.auth.mode` : Kafka Authentication mode. It can be one of KAFKA_API_KEY or SERVICE_ACCOUNT. It defaults to KAFKA_API_KEY mode, whenever possible.
* Type: string * Valid Values: SERVICE_ACCOUNT, KAFKA_API_KEY * Importance: high `kafka.api.key` : Kafka API Key. Required when kafka.auth.mode==KAFKA_API_KEY.
* Type: password * Importance: high `kafka.service.account.id` : The Service Account that will be used to generate the API keys to communicate with Kafka Cluster.
* Type: string * Importance: high `kafka.api.secret` : Secret associated with Kafka API key. Required when kafka.auth.mode==KAFKA_API_KEY.
* Type: password * Importance: high ### How should we connect to Splunk? `splunk.hec.uri` : Either a list of FQDNs or IPs of all Splunk indexers, separated with a ‘,’ or a load balancer. The connector will load balance to indexers using round robin. Example: [https://hec1.splunk.com:8088,https://hec2.splunk.com:8088,https://hec3.splunk.com:8088](https://hec1.splunk.com:8088,https://hec2.splunk.com:8088,https://hec3.splunk.com:8088).
* Type: string * Importance: high `splunk.hec.token` : Splunk HTTP Event Collector token.
* Type: password * Importance: high `splunk.hec.ssl.validate.certs` : Enables or disables HTTPS certification validation.
* Type: boolean * Default: true * Importance: medium `splunk.hec.ssl.trust.store.file` : The certificate trust store containing the certificates required to validate the SSL connection.
* Type: password * Default: [hidden] * Importance: high `splunk.hec.ssl.trust.store.password` : Password for the certificate trust store.
* Type: password * Importance: high ### Metadata configuration `splunk.indexes` : Splunk index names for Kafka topic data separated by comma for multiple topics to indexers (“prod-index1,prod-index2,prod-index3”).
* Type: string * Default: default * Importance: medium `splunk.sourcetypes` : Splunk event sourcetype metadata for Kafka topic data.
* Type: string * Importance: medium `splunk.sources` : Splunk event source metadata for Kafka topic data.
* Type: string * Importance: medium ### Endpoint configuration `splunk.hec.raw` : When set to true, the connector ingests data using the the /raw HEC endpoint.
* Type: boolean * Default: false * Importance: medium `splunk.hec.raw.line.breaker` : Only applicable to /raw HEC endpoint. The setting is used to specify a custom line breaker to help Splunk separate the events correctly.
* Type: string * Importance: medium `splunk.hec.json.event.enrichment` : Only applicable to /event HEC endpoint. This setting is used to enrich raw data with extra metadata fields. It contains a list of key value pairs separated by “,”.
* Type: string * Importance: low `splunk.hec.track.data` : Only applicable to /event HEC endpoint. When set to true, data loss and data injection latency metadata will be indexed along with raw data.
* Type: boolean * Default: false * Importance: low ### HEC configuration `splunk.hec.http.keepalive` : Enables or disables HTTP connection keep-alive.
* Type: boolean * Default: true * Importance: medium `splunk.hec.max.http.connection.per.channel` : Max HTTP connections pooled for one HEC Channel when posting events to Splunk.
* Type: int * Default: 2 * Importance: medium `splunk.hec.total.channels` : Total HEC Channels used to post events to Splunk.
* Type: int * Default: 2 * Importance: high `splunk.hec.socket.timeout` : Max duration in seconds to read / write data to network before internal TCP Socket timeout.
* Type: int * Default: 10 * Importance: low `splunk.hec.use.record.timestamp` : When set to true, The timestamp is retrieved from the Kafka record and passed to Splunk as a HEC metadata override.
* Type: boolean * Default: true * Importance: medium `splunk.hec.threads` : The number of threads spawned to do data injection via HEC in a single connector task.
* Type: int * Default: 1 * Valid Values: [1,…,10] * Importance: low `splunk.hec.max.outstanding.events` : Maximum amount of unacknowledged events kept in memory by connector. Will trigger back-pressure event to slow collection.
* Type: int * Default: 10000 * Valid Values: [10000,…,100000] * Importance: medium `splunk.hec.max.retries` : Number of retries for failed batches before giving up. By default this is set to -1 which will retry indefinitely.
* Type: int * Default: -1 * Importance: medium `splunk.hec.backoff.threshhold.seconds` : The amount of time the connector waits on errors sending events to Splunk to attempt resending it.
* Type: int * Default: 60 * Importance: medium `splunk.hec.json.event.formatted` : Set to true for events that are already in HEC format.
* Type: boolean * Default: false * Importance: low `splunk.hec.max.batch.size` : Maximum batch size when posting events to Splunk. The size is the actual number of Kafka events not the byte size.
* Type: int * Default: 500 * Importance: medium `splunk.hec.lb.poll.interval` : This setting controls the load balancer polling interval.
* Type: int * Default: 120 * Importance: low `splunk.flush.window` : The interval in seconds at which the events from kafka will be flushed to Splunk.
* Type: int * Default: 30 * Importance: low ### Acknowledgement configuration `splunk.hec.ack.enabled` : When set to true the connector will poll event ACKs for POST events before check-pointing the Kafka offsets. This is used to prevent data loss, as this setting implements guaranteed delivery.
* Type: boolean * Default: false * Importance: medium `splunk.hec.ack.poll.interval` : This setting is only applicable when splunk.hec.ack.enabled is set to true. Internally it controls the event ACKs polling interval.
* Type: int * Default: 10 * Importance: medium `splunk.hec.ack.poll.threads` : This setting is only applicable when splunk.hec.ack.enabled is set to true. It controls how many threads should be spawned to poll event ACKs.
* Type: int * Default: 1 * Valid Values: [1,…,10] * Importance: medium `splunk.hec.event.timeout` : This setting is only applicable when splunk.hec.ack.enabled is set to true. When events are POSTed to Splunk and before they are ACKed, this setting determines how long the connector will wait before timing out and resending.
* Type: int * Default: 300 * Importance: medium ### Headers configuration `splunk.header.support` : When set to true the connector will parse Kafka headers for use as metadata in Splunk events.
* Type: boolean * Default: false * Importance: medium `splunk.header.custom` : This setting will look for kafka record headers with these values and add them to each event if present. Custom headers are configured separated by comma for multiple headers. Example: “custom_header_1,custom_header_2,custom_header_3”.
* Type: string * Importance: medium `splunk.header.index` : Header to use for Splunk Header Index
* Type: string * Default: splunk.header.index * Importance: medium `splunk.header.source` : Header to use for Splunk Header Source
* Type: string * Default: splunk.header.source * Importance: medium `splunk.header.sourcetype` : Header to use for Splunk Header Sourcetype
* Type: string * Default: splunk.header.sourcetype * Importance: medium `splunk.header.host` : Header to use for Splunk Header Host
* Type: string * Default: splunk.header.host * Importance: medium ### Consumer configuration `max.poll.interval.ms` : The maximum delay between subsequent consume requests to Kafka. This configuration property may be used to improve the performance of the connector, if the connector cannot send records to the sink system. Defaults to 300000 milliseconds (5 minutes).
* Type: long * Default: 300000 (5 minutes) * Valid Values: [60000,…,1800000] for non-dedicated clusters and [60000,…] for dedicated clusters * Importance: low `max.poll.records` : The maximum number of records to consume from Kafka in a single request. This configuration property may be used to improve the performance of the connector, if the connector cannot send records to the sink system. Defaults to 500 records.
* Type: long * Default: 500 * Valid Values: [1,…,500] for non-dedicated clusters and [1,…] for dedicated clusters * Importance: low ### Number of tasks for this connector `tasks.max` : Maximum number of tasks for the connector.
* Type: int * Valid Values: [1,…] * Importance: high ### Auto-restart policy `auto.restart.on.user.error` : Enable connector to automatically restart on user-actionable errors.
* Type: boolean * Default: true * Importance: medium ### Additional Configs `consumer.override.auto.offset.reset` : Defines the behavior of the consumer when there is no committed position (which occurs when the group is first initialized) or when an offset is out of range. You can choose either to reset the position to the “earliest” offset (the default) or the “latest” offset. You can also select “none” if you would rather set the initial offset yourself and you are willing to handle out of range errors manually. More details: [https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#auto-offset-reset](https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#auto-offset-reset)
* Type: string * Importance: low `consumer.override.isolation.level` : Controls how to read messages written transactionally. If set to read_committed, consumer.poll() will only return transactional messages which have been committed. If set to read_uncommitted (the default), consumer.poll() will return all messages, even transactional messages which have been aborted. Non-transactional messages will be returned unconditionally in either mode. More details: [https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#isolation-level](https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#isolation-level)
* Type: string * Importance: low `header.converter` : The converter class for the headers. This is used to serialize and deserialize the headers of the messages.
* Type: string * Importance: low `key.converter.use.schema.guid` : The schema GUID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema GUID to be used for deserializing message keys. Only applicable when key.converter.key.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
* Type: string * Importance: low `key.converter.use.schema.id` : The schema ID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema ID to be used for deserializing message keys. Only applicable when key.converter.key.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
* Type: int * Importance: low `value.converter.allow.optional.map.keys` : Allow optional string map key when converting from Connect Schema to Avro Schema. Applicable for Avro Converters.
* Type: boolean * Importance: low `value.converter.auto.register.schemas` : Specify if the Serializer should attempt to register the Schema.
* Type: boolean * Importance: low `value.converter.connect.meta.data` : Allow the Connect converter to add its metadata to the output schema. Applicable for Avro Converters.
* Type: boolean * Importance: low `value.converter.enhanced.avro.schema.support` : Enable enhanced schema support to preserve package information and Enums. Applicable for Avro Converters.
* Type: boolean * Importance: low `value.converter.enhanced.protobuf.schema.support` : Enable enhanced schema support to preserve package information. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.flatten.unions` : Whether to flatten unions (oneofs). Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.generate.index.for.unions` : Whether to generate an index suffix for unions. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.generate.struct.for.nulls` : Whether to generate a struct variable for null values. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.int.for.enums` : Whether to represent enums as integers. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.latest.compatibility.strict` : Verify latest subject version is backward compatible when use.latest.version is true.
* Type: boolean * Importance: low `value.converter.object.additional.properties` : Whether to allow additional properties for object schemas. Applicable for JSON_SR Converters.
* Type: boolean * Importance: low `value.converter.optional.for.nullables` : Whether nullable fields should be specified with an optional label. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.optional.for.proto2` : Whether proto2 optionals are supported. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.use.latest.version` : Use latest version of schema in subject for serialization when auto.register.schemas is false.
* Type: boolean * Importance: low `value.converter.use.optional.for.nonrequired` : Whether to set non-required properties to be optional. Applicable for JSON_SR Converters.
* Type: boolean * Importance: low `value.converter.use.schema.guid` : The schema GUID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema GUID to be used for deserializing message values. Only applicable when value.converter.value.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
* Type: string * Importance: low `value.converter.use.schema.id` : The schema ID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema ID to be used for deserializing message values. Only applicable when value.converter.value.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
* Type: int * Importance: low `value.converter.wrapper.for.nullables` : Whether nullable fields should use primitive wrapper messages. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.wrapper.for.raw.primitives` : Whether a wrapper message should be interpreted as a raw primitive at root level. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `key.converter.key.schema.id.deserializer` : The class name of the schema ID deserializer for keys. This is used to deserialize schema IDs from the message headers.
* Type: string * Default: io.confluent.kafka.serializers.schema.id.DualSchemaIdDeserializer * Importance: low `key.converter.key.subject.name.strategy` : How to construct the subject name for key schema registration.
* Type: string * Default: TopicNameStrategy * Importance: low `value.converter.decimal.format` : Specify the JSON/JSON_SR serialization format for Connect DECIMAL logical type values with two allowed literals:
BASE64 to serialize DECIMAL logical types as base64 encoded binary data and
NUMERIC to serialize Connect DECIMAL logical type values in JSON/JSON_SR as a number representing the decimal value.
* Type: string * Default: BASE64 * Importance: low `value.converter.flatten.singleton.unions` : Whether to flatten singleton unions. Applicable for Avro and JSON_SR Converters.
* Type: boolean * Default: false * Importance: low `value.converter.reference.subject.name.strategy` : Set the subject reference name strategy for value. Valid entries are DefaultReferenceSubjectNameStrategy or QualifiedReferenceSubjectNameStrategy. Note that the subject reference name strategy can be selected only for PROTOBUF format with the default strategy being DefaultReferenceSubjectNameStrategy.
* Type: string * Default: DefaultReferenceSubjectNameStrategy * Importance: low `value.converter.value.schema.id.deserializer` : The class name of the schema ID deserializer for values. This is used to deserialize schema IDs from the message headers.
* Type: string * Default: io.confluent.kafka.serializers.schema.id.DualSchemaIdDeserializer * Importance: low `value.converter.value.subject.name.strategy` : Determines how to construct the subject name under which the value schema is registered with Schema Registry.
* Type: string * Default: TopicNameStrategy * Importance: low ## Frequently asked questions Find answers to frequently asked questions about the Splunk Sink connector for Confluent Cloud. ### Deployment model and product fit #### Can I run Splunk Sink on my own Kafka Connect cluster (self-managed)? No. The Splunk Sink connector for Confluent Cloud is available only as a fully managed connector. For self-managed environments, see [Splunk Sink Connector for Confluent Platform](https://docs.confluent.io/kafka-connectors/splunk-sink/current/). ### Authentication and HEC token #### Why am I getting authentication errors with my HEC token? You might encounter authentication failures with the Splunk HTTP Event Collector (HEC) token. Verify the following: * **Token validity**: Ensure the HEC token is active and not expired or revoked in your Splunk instance. * **Token format**: The token should be entered exactly as generated from Splunk without additional characters or spaces. * **Token permissions**: Verify the token has appropriate permissions to write to the target index. * **Index configuration**: Confirm that the default index configured for the HEC token exists and is accessible. To verify your HEC token, test it using `curl`: ```bash curl https://:8088/services/collector \ -H "Authorization: Splunk " \ -d '{"event":"test event"}' ``` If your Splunk HEC endpoint uses a self-signed certificate or otherwise fails TLS verification in a non-production environment, you can temporarily disable verification for troubleshooting only: ```bash curl --insecure https://:8088/services/collector \ -H "Authorization: Splunk " \ -d '{"event":"test event"}' ``` Do not use `--insecure` (`-k`) in production, as it disables TLS certificate verification. If `curl` succeeds but the connector fails, check the connector logs for specific error messages. #### What does `Invalid HEC token` mean and how do I fix it? Splunk rejects the HEC token and returns this error. Common causes include: * The token was deleted or disabled in Splunk. * The token string was copied incorrectly (extra spaces, truncated characters). * The Splunk instance requires a different token than what was configured. **Solution**: Generate a new HEC token in Splunk and update the connector configuration with the new token value. ### SSL/TLS configuration #### Why do I see `Invalid HTTPS configuration. Certificate validation requires a valid trust store file`? You see this error when you configure the connector to validate SSL certificates without providing a trust store. For Confluent Cloud fully managed connectors connecting to Splunk Cloud or self-signed certificates: * The connector automatically trusts certificates from well-known Certificate Authorities (CAs). * If your Splunk instance uses a certificate from a standard CA (such as DigiCert, Let’s Encrypt), no additional configuration is needed. * For self-signed certificates or internal CAs, contact [Confluent Support](https://support.confluent.io/) for assistance with custom certificate configuration. #### Why am I getting SSL handshake or certificate errors? SSL/TLS errors typically mean certificate validation failed. Common causes: * **Self-signed certificates**: The Splunk instance uses a self-signed certificate not trusted by default. * **Expired certificates**: The Splunk server certificate has expired. * **Hostname mismatch**: The certificate Common Name (CN) does not match the Splunk HEC URI hostname. **Solution**: * Ensure your Splunk instance uses a valid certificate from a trusted CA. * Verify the certificate is not expired using: `openssl s_client -connect :8088` * Confirm the certificate CN matches your `splunk.hec.uri` hostname. ### Network connectivity #### Why am I getting `Connect timed out` errors? Connection timeout errors mean the connector cannot reach the Splunk HEC endpoint. This is typically a networking issue. **For public Splunk endpoints:** * The required allowlisting depends on the networking configuration of your Confluent Cloud cluster. * **Public Endpoint clusters:** Connector egress uses Confluent-managed static public IP addresses. \* Allowlist the static egress IP addresses for your environment and region on the Splunk side. \* See [Static egress IP addresses](../networking/static-egress-ip-addresses.md#static-egress-ip-addresses) for the exact ranges to allowlist. * **Private networking clusters (Private Link, VPC Peering, Transit Gateway) reaching a public Splunk endpoint:** Egress to the internet may use cloud provider NAT gateways with dynamic public IPs from the provider’s regional ranges. \* The connector egresses from a dynamic public IP or CIDR range in the cloud provider region where your cluster is located. These ranges are the provider’s, not Splunk-specific. For the IP range used by each cluster network type, see [Egress IP address ranges](networking/internet-resource.md#cloud-connect-egress-ip-address-range). To list a provider’s published ranges for a region, for example, AWS `us-east-1`, run: ```bash curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | \ jq -r '.prefixes[] | select(.region == "us-east-1") | .ip_prefix' | sort -u ``` **For private Splunk endpoints (for example, VPC Peering/Transit Gateway):** \* Verify DNS forwarding is configured correctly when using private DNS. \* Confirm security groups and firewall rules allow traffic from the Confluent Cloud CIDR range. \* The source IP address comes from the /16 CIDR range configured for your Confluent Cloud cluster. **Checklist:** 1. Verify your Splunk HEC endpoint is reachable from the internet (for public endpoints) or from the Confluent Cloud network (for private endpoints). 2. Confirm port `8088` (or your custom HEC port) is open and accessible. 3. Check firewall and security group rules at your Splunk perimeter. 4. Ensure network type (PUBLIC, PRIVATE_LINK, VPC_PEERING) matches your cluster configuration. #### Which IP addresses do I need to allowlist for the connector? The IP addresses depend on your cluster network type: **Public clusters or public Splunk endpoints:** * The connector can use any IP address from your cloud provider’s region. * Allowlist the complete IP range for your specific region and cloud provider. * For current ranges, see the [Static egress IP addresses](../networking/static-egress-ip-addresses.md#static-egress-ip-addresses). **Private clusters with VPC Peering or Transit Gateway:** * The connector uses IP addresses from the /16 CIDR range configured for your Confluent Cloud cluster. * Allowlist your cluster’s CIDR range in your Splunk instance’s firewall rules. #### NOTE Public egress IPs are not available on private Dedicated clusters. For private Dedicated clusters connecting to public endpoints, the connector uses the cloud provider’s regional IP ranges. ### Configuration and data format #### Why are my events not appearing in Splunk? If the connector status is `RUNNING` but Splunk does not show your events: * **Check the connector lag**: In the Cloud Console, verify the connector is consuming messages (lag should decrease). * **Verify the HEC endpoint**: Ensure `splunk.hec.uri` is correctly formatted. Use a single endpoint URL for a load balancer, or a comma-separated list for multiple Splunk indexers: ```json "splunk.hec.uri": "https://hec1.splunk.com:8088,https://hec2.splunk.com:8088" ``` * **Check Splunk indexes**: Verify events are being written to the expected index. Check both the default index for your HEC token and any index specified in the data. * **Review the Dead Letter Queue (DLQ)**: Check the DLQ topic for failed records. See [View Connector Dead Letter Queue Errors in Confluent Cloud](dead-letter-queue.md#ccloud-dlq-topics). * **Examine connector logs**: Look for serialization errors or data format mismatches. #### What data formats are supported and how do I configure them? The connector supports the following input data formats from Kafka: * **AVRO**: Requires Confluent Cloud Schema Registry to be enabled * **JSON_SR (JSON Schema)**: Requires Confluent Cloud Schema Registry to be enabled * **PROTOBUF**: Requires Confluent Cloud Schema Registry to be enabled * **JSON**: Schemaless JSON format * **STRING**: Plain text format Configure the format using the `input.data.format` property: ```json { "input.data.format": "AVRO" } ``` For schema-based formats (AVRO, JSON_SR, PROTOBUF), ensure Confluent Cloud Schema Registry is enabled in your environment. See [Schema Registry](../get-started/schema-registry.md#cloud-sr-config). #### Why am I getting `Failed to serialize Avro data` errors? You see serialization errors when the connector cannot process the message format: * **Schema mismatch**: The message schema does not match the expected schema in Confluent Cloud Schema Registry. * **Schema evolution issues**: Schema changes are incompatible with the configured compatibility mode. * **Corrupted messages**: The message payload is malformed or corrupted. **Solution**: 1. Verify the schema exists in Confluent Cloud Schema Registry and matches your data structure. 2. Check Confluent Cloud Schema Registry compatibility settings for the subject. 3. Review the DLQ topic for the failing messages and their error details. 4. Ensure the `input.data.format` setting matches the actual message format in the topic. ### Performance and scaling #### How do I improve connector throughput? To optimize connector performance: * **Increase tasks**: Add more tasks to parallelize consumption. The connector supports running multiple tasks. ```json "tasks.max": "4" ``` * **Optimize batch size**: The connector batches events before sending to Splunk. Monitor the connector lag and adjust tasks accordingly. * **Use load balancing**: Configure multiple Splunk indexers in `splunk.hec.uri` for better distribution: ```json "splunk.hec.uri": "https://hec1.splunk.com:8088,https://hec2.splunk.com:8088,https://hec3.splunk.com:8088" ``` * **Check Splunk capacity**: Ensure your Splunk cluster can handle the ingestion rate. #### The connector is healthy but lag is constant. Is this normal? A consistent lag of `1 per partition` is normal Kafka Connect behavior. The connector pre-fetches the next record before committing the current offset. Unless lag is growing, a small constant lag indicates healthy operation. If lag is increasing: * Check Splunk HEC endpoint performance and availability. * Increase the number of tasks to improve throughput. * Monitor Splunk indexer capacity and network bandwidth. * Review connector logs for throttling or retry messages. ## Next Steps For an example that shows fully managed Confluent Cloud connectors in action with Confluent Cloud for Apache Flink, see the [Cloud ETL Demo](/platform/current/tutorials/examples/cloud-etl/docs/index.html). This example also shows how to use Confluent CLI to manage your resources in Confluent Cloud. [![image](images/topology.png)](https://docs.confluent.io/platform/current/tutorials/examples/cloud-etl/docs/index.html)