Is there any alternative option for fluent-plugin-splunk-hec fluentd pluin available?

[moharana-subhashree]

hi,
As per this https://github.com/splunk/fluent-plugin-splunk-hec , fluent-plugin-splunk-hec plugin supports won't be available from Jan 2024.
version - td-agent - 4.4.2 fluentd 1.15.3.

shall we need to remove deprecated one and consider using fluent-plugin-splunk-enterprise as mentioned in https://github.com/fluent/fluent-plugin-splunk ?
or do you suggest any other alternative for fluent-plugin-splunk-hec plugin ?

[cosmo0920]

@ashie @kenhys @daipom Did you mind if you all handled this issue? And do you all have any suggestions?
This is because splunk is quite large stake on the data analytics business so, we need to handle at some point even if the Fluentd core team doesn't like such proprietary software, actually...

[daipom]

Sorry. I don't understand the situation.
What is the difference between fluent-plugin-splunk-enterprise and fluent-plugin-splunk-hec?
It seems both repositories have out_splunk_hec feature.

[cosmo0920]

The main topic is the official Splunk team will drop their support for Fluentd plugin.

Important: The fluent-plugin-splunk-hec will reach End of Support on January 1, 2024. After that date, this repository will no longer receive updates from Splunk and will no longer be supported by Splunk. Until then, only critical security fixes and bug fixes will be provided.

This means that the "official" Fluentd plugin won't be existing after fluent-plugin-splunk-hec is declared EOL. This could be caused to avoid trying to use Fluentd.

The major difference are:

• Whether supporting ingest api or not.
• Whether supporting to send metrics type of events or not.

As far as I can tell, nowadays, sending metrics is important to support observabilities.

e.g.) What is observability?