Installation Guide¶

Quick Start¶

Create a values.yaml file with your configuration:

kafkaReceivers:
  - name: main
    brokers:
      - "kafka-broker:9092"
    logs:
      topics:
        - "application-logs"
      encoding: text
    group_id: "soc4kafka-main"

splunkExporters:
  - name: primary
    endpoint: "https://splunk-hec:8088/services/collector"
    token: "your-splunk-hec-token"
    source: "soc4kafka"
    sourcetype: "otel:logs"
    index: "main"
    sending_queue:
      enabled: true
      num_consumers: 10
      queue_size: 10000
      block_on_overflow: true
      sizer: items
      batch:
        min_size: 1000

pipelines:
  - name: main-logs
    type: logs
    receivers:
      - main
    exporters:
      - primary
    # processors optional; defaults to ["resourcedetection"] (defaults.pipelineProcessors in values.yaml)

Add helm repository:

helm repo add splunk-opentelemetry-collector-for-kafka https://splunk.github.io/splunk-opentelemetry-collector-for-kafka

Install the chart:

helm upgrade --install soc4kafka splunk-opentelemetry-collector-for-kafka/splunk-opentelemetry-collector-for-kafka -f values.yaml

Note

For information about managing secrets (auto-created or existing Kubernetes secrets), see Secret Management.

Upgrading¶

# Update your values.yaml file with new configuration, then upgrade
helm upgrade soc4kafka splunk-opentelemetry-collector-for-kafka/splunk-opentelemetry-collector-for-kafka -f values.yaml

# Or use multiple values files (useful for environment-specific overrides)
helm upgrade soc4kafka splunk-opentelemetry-collector-for-kafka/splunk-opentelemetry-collector-for-kafka -f values.yaml -f values-prod.yaml

Note

Best Practice: Always use values files (-f values.yaml) instead of --set flags. This makes your configuration version-controlled, easier to maintain, and reusable across environments.

Rolling updates (default behaviour)¶

By default, the chart uses a rolling update strategy (maxSurge: 25%, maxUnavailable: 25%). Pods are updated in waves so that the majority stay running during an upgrade.

Warning

When you change collector configuration (for example, index, pipeline, or Splunk HEC settings) and run helm upgrade, only a subset of pods receive the new config at a time. Until the rollout finishes, some pods still run with the old config. As a result, events from different Kafka partitions can be indexed or processed differently during the rollout (e.g. different index or sourcetype). With 25%, fewer partitions are affected in each wave. After all pods are updated, behaviour is consistent again.

If you need strictly sequential or consistent indexing during config changes, you can set strategy.type: Recreate in your values. That restarts all pods at once; expect a short period with no ingestion until the new pods are ready.

Uninstallation¶

helm uninstall soc4kafka

Note

This will delete the deployment, but secrets created outside the chart will remain. Auto-created secrets will be deleted.