Splunk OTLP Capture Guide For Unified aiFObserve

Best Capture Source

Export security events from Splunk Enterprise, Splunk Cloud, or Splunk Enterprise Security through an OTLP-capable pipeline. Preserve index, sourcetype, source, CIM fields, and raw event text.

Basic Logging

• _time or event timestamp
• src, dst (CIM canonical names — preferred; dest is also recognized)
• src_ip, dest_ip
• src_port, dest_port
• transport or protocol
• action
• url, uri, http_user_agent, http_method, status
• user (CIM canonical name — preferred; src_user, srcuser, and dest_user are also recognized as of this guide's revision — older converter builds only recognized bare user and would silently fall back to source IP as the identity)
• app, app_category, vendor_product
• bytes, bytes_in, bytes_out

Extended Logging

• index, sourcetype, source, host
• Splunk ES notable event fields
• CIM Network_Traffic, Web, Authentication, and Alerts fields
• risk object and risk score
• MITRE tactic/technique fields
• correlation search name
• raw event body
• location and asset/identity enrichment

User And App Identity

• CIM user
• src_user, dest_user
• identity lookup-enriched fields
• app, app_category, vendor_product
• URL/host/domain fields

OTLP Mapping Notes

Map Splunk metadata into attributes such as splunk.index, splunk.sourcetype, splunk.source, and event.original. Keep CIM field names alongside vendor raw fields when possible.

Source

• https://opentelemetry.io/docs/specs/otel/logs/data-model/