[talwgx]

With pipelines/run/output/event/fluentbit/splunk.yaml, Fluent Bit now starts and the events reach Splunk HEC, under the sourcetype set in SPLUNK_SOURCETYPE (_json when it is not set). Before, the templates output passed Splunk properties to the es plugin, Fluent Bit 5.1.5 stopped at startup (es: unknown configuration property 'splunk_token', output initialization failed), and no event was sent.

What changed

• Templates output: -o es becomes -o splunk, which is the plugin its properties belong to.
• Events output: event_sourcetype comes from SPLUNK_SOURCETYPE, default _json. The events this output sends are the full text of each event, as {"text": "<event>"}, not compact events, so they are no longer labelled tenx_encoded. In the 10x Splunk app (tenx-for-splunk/default), every event of that sourcetype is treated as compact: tenx-events selects sourcetype::tenx_encoded, REPORT-tenx reads a template hash from the text before the first comma (the leading ~ is optional in its regex), and TRANSFORMS-tenx_time can set _time from a 13- or 19-digit number that follows that comma. _json describes the body as sent; SPLUNK_SOURCETYPE lets a deployment use the sourcetype its searches expect for this data.

Checked

Engine 1.1.153 (jar, stdin input, Receiver app) with this file as the output, Fluent Bit 5.1.5, and a stand-in HEC endpoint (TLS, tls.verify=on against its own CA) that stores each request; 6 input lines. For the run, the output's command pointed at a script that starts Fluent Bit 5.1.5 in a container; nothing else in the file differed.

file	Fluent Bit	requests	events, sourcetype
main	stopped at startup with the error above	0	none
this branch	started	2	6 of 6, _json; each event.text equal to its input line, in order
this branch, SPLUNK_SOURCETYPE=aws:cloudtrail	started	1	6 of 6, aws:cloudtrail

No template record was sent in any run: writeTemplates is false in this file, so the templates output receives nothing. In one more run of this branch the engine reached the end of its input, started Fluent Bit and closed its input within the same second, and Fluent Bit stopped before sending (0 requests); that is in the engine, not in this file.

node --test tests/: 15 of 15.

🤖 Generated with Claude Code