o11y IM OTEL/Conf Discovery rules (receiver_creator)
Available Languages
Applicability
Splunk Infrastructure MonitoringDescription
OTEL use different rules than the SmartAgent
Github open-telemetry collector receivercreator rule-expressions
Each rule must start with type == ("pod"|"port"|"hostport") && such that the rule matches only one endpoint type. Depending on the type of endpoint the rule is targeting it will have different variables available.
Pod
| Variable | Description |
|---|---|
| type | "pod" |
| name | name of the pod |
| namespace | namespace of the pod |
| uid | unique id of the pod |
| labels | map of labels set on the pod |
| annotations | map of annotations set on the pod |
Port
| Variable | Description |
|---|---|
| type | "port" |
| name | container port name |
| port | port number |
| protocol | The transport protocol ("TCP" or "UDP") |
| pod.name | name of the owning pod |
| pod.namespace | namespace of the pod |
| pod.uid | unique id of the pod |
| pod.labels | map of labels of the owning pod |
| pod.annotations | map of annotations of the owning pod |
Host Port
| Variable | Description |
|---|---|
| type | "hostport" |
| process_name | Name of the process |
| command | Command line with the used to invoke the process |
| is_ipv6 | true if endpoint is IPv6, otherwise false |
| port | Port number |
| transport | The transport protocol ("TCP" or "UDP") |
-----------------
~= operator is now translated to matches
For example
type == "port" && pod.name matches "test" && port == 9102
-----------------
When the original Discovery Rule was targeting container instead of pod name. For a pod containing multiple container sidecars how this would work?
Pod or port should be able to work. If you did a rule with container you'd need to provide a port number. In that case you should use a rule with pod and provide port number. Otherwise if you have a container port entry use port.
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
29-Sep-2026
|
Initial Release |
Feedback