The official Splunk documentation for this page is Determine your deployment mode. For instructions on how to contribute to the docs, see CONTRIBUTING.md.
Splunk OpenTelemetry Collector provides a single binary and two deployment modes as outlined in the architecture. The recommended getting started installation steps cover deploying in either mode and come with a default configuration.
IMPORTANT: The configuration is different for each mode.
Configuration changes from the default that may be desirable include:
- Removing unneeded components; see security.md
- Configuring processors such as the attributes processor
- Exporting to gateway
Agent mode should be used when Splunk OpenTelemetry Collector is running with the application or on the same host as the application (e.g. binary, sidecar, or DaemonSet). Application instrumentation should be configured to send data to Splunk OpenTelemetry Collector running in agent mode. Doing so offloads responsibilities from the application including batching, queuing, retry, etc. In addition, agent mode allows for the collection of host and application metrics as well as host and application metadata enrichment for metrics, spans, and logs.
By default, Splunk OpenTelemetry Collector in agent mode is configured to send data directly to Splunk Observability Cloud. Alternatively, it can be configured to send to Splunk OpenTelemetry Collector in gateway mode. To send data to a gateway, change the configuration:
- Update
extensions.http_forwarder.egress.endpoint(supports${SPLUNK_GATEWAY_URL}environment variable) - Update
exporters.otlp.endpoint(supports${SPLUNK_GATEWAY_URL}environment variable) - Update
service.pipelines.[traces|metrics|logs].exporters
Gateway mode should be used when one or more Splunk OpenTelemetry Collectors are running as a standalone service (e.g. container or deployment); typically gateway mode is deployed per cluster, datacenter, or region. Splunk OpenTelemetry Collector running in agent mode or serverless instrumentation can be configured to send data to Splunk OpenTelemetry Collector running in gateway mode. Doing so offers capabilities including increased buffer and retry as well as egress and token management control.
Splunk OpenTelemetry Collector running in gateway mode as an optional component for specific use cases.