Skip to content

Migration config values

Config mapping between SC4Kafka and SOC4Kafka

In the OpenTelemetry (OTel) Collector, parameters are configured individually per exporter (data sink) or per receiver (data source), rather than being specified in a single consolidated table. This modular approach allows greater flexibility and customization for defining pipelines, but it differs fundamentally from the configuration style used in the Splunk Connect for Kafka.

Fields supported by SOC4Kafka

Field SOC4Kafka Field Comments
topics receivers.kafka.logs.topics Each Kafka receiver can be configured with a single topic, but multiple receivers can be composed together in a pipeline as a list. Take a look at this doc.
topics.regex receivers.kafka.logs.topics In order to use regex, prefix your topic with ^ character. Read more here.
splunk.indexes exporters.splunk_hec.index Each Splunk HEC exporter can be configured with a single index, but multiple exporters can be composed together in a pipeline as a list.
splunk.sources exporters.splunk_hec.source Each Splunk HEC exporter can be configured with a single source, but multiple exporters can be composed together in a pipeline as a list.
splunk.sourcetypes exporters.splunk_hec.sourcetype Each Splunk HEC exporter can be configured with a single sourcetype, but multiple exporters can be composed together in a pipeline as a list.
splunk.hec.uri exporters.splunk_hec.endpoint The endpoint for the Splunk HEC.
splunk.hec.token exporters.splunk_hec.token Token for authenticating with Splunk HEC.
splunk.hec.raw exporters.splunk_hec.export_raw Sends only the log’s body, targeting a Splunk HEC raw endpoint.
splunk.hec.ssl.validate.certs exporters.splunk_hec.tls.insecure_skip_verify Specifies whether to skip certificate validation for the HEC endpoint when using HTTPS. Defaults to false.
splunk.hec.http.keepalive exporters.splunk_hec.health_check_enabled Specifies whether to perform a Splunk HEC health check during the exporter’s startup.
splunk.hec.max.http.connection.per.channel exporters.splunk_hec.max_idle_conns Configures the maximum number of simultaneous HTTP connections to Splunk HEC. Defaults to 100.
splunk.hec.max.batch.size splunk_hec.sending_queue.batch.min_size Specifies the number of spans, metric data points, or log records to batch before sending. The default is 1000.
splunk.hec.event.timeout splunk.timeout Configures timeout for Splunk exporter operations.
splunk.hec.socket.timeout splunk.socket.timeout Configures socket timeout for Splunk exporter operations.
splunk.header.support receivers.kafka.header_extraction.extract_headers When set to true, the Kafka receiver will parse headers for use as metadata in Splunk events. See the header extraction guide.
splunk.header.custom receivers.kafka.header_extraction.headers Custom headers can be extracted and used through custom processors.
splunk.header.index exporters.splunk_hec.otel_attrs_to_hec_metadata.index Kafka header values can be mapped to Splunk index attributes via custom processors.
splunk.header.source exporters.splunk_hec.otel_attrs_to_hec_metadata.source Kafka header values can be mapped to Splunk source attributes via custom processors.
splunk.header.sourcetype exporters.splunk_hec.otel_attrs_to_hec_metadata.sourcetype Kafka header values can be mapped to Splunk sourcetype attributes via custom processors.
splunk.header.host exporters.splunk_hec.otel_attrs_to_hec_metadata.host Kafka header values can be mapped to Splunk host attributes via custom processors.
enable.timestamp.extraction processors.timestamp Timestamp extraction can be configured using processors in SOC4Kafka. Refer to the timestamp extraction guide for details.
timestamp.regex processors.timestamp.regex Specifies the regular expression for extracting timestamps from log data.
timestamp.format processors.timestamp.format Defines the format for extracted timestamps.
timestamp.timezone processors.timestamp.timezone Specifies the timezone for extracted timestamps.

Fields not supported by SOC4Kafka

Field Comments
connector.class SOC4Kafka does not require a connector class; configuration is achieved using receivers, processors, and exporters.
tasks.max Task management is handled differently in SOC4Kafka. Refer to the scaling documentation for more details.
splunk.hec.raw.line.breaker Line breaker configuration is achieved through custom processors in SOC4Kafka.
splunk.hec.json.event.enrichment JSON enrichment is achieved through custom processors in SOC4Kafka.
splunk.hec.auto.extract.timestamp Timestamp extraction can be configured using processors. Refer to the timestamp guide.
value.converter This feature is not supported in SOC4Kafka.
value.converter.schema.registry.url This feature is not supported in SOC4Kafka.
value.converter.schemas.enable This feature is not supported in SOC4Kafka.
key.converter This feature is not supported in SOC4Kafka.
key.converter.schema.registry.url This feature is not supported in SOC4Kafka.
key.converter.schemas.enable This feature is not supported in SOC4Kafka.
splunk.hec.ack.enabled This feature is not supported in SOC4Kafka.
splunk.hec.ack.poll.interval This feature is not supported in SOC4Kafka.
splunk.hec.ack.poll.threads This feature is not supported in SOC4Kafka.
splunk.hec.total.channels The concept of “channels” is not used in SOC4Kafka.
splunk.hec.threads Threading is managed differently in SOC4Kafka and does not require explicit configuration.
splunk.hec.track.data Data tracking and debugging must be handled through custom processors or external monitoring tools.
splunk.hec.json.event.formatted Events that are already in HEC format must be sent using the exporters.splunk_hec.export_raw option.
splunk.hec.ssl.trust.store.path Trust store configuration is not supported in SOC4Kafka.
splunk.hec.ssl.trust.store.password
kerberos.user.principal Kerberos authentication is supported by the Kafka receiver in SOC4Kafka. Configuration details can be found here.
kerberos.keytab.path