Splunk OTLP Capture Guide For Unified aiFObserve

Best Capture Source

Export security events from Splunk Enterprise, Splunk Cloud, or Splunk Enterprise Security through an OTLP-capable pipeline. Preserve index, sourcetype, source, CIM fields, and raw event text.

Basic Logging

• _time or event timestamp
• src, dest
• src_ip, dest_ip
• src_port, dest_port
• transport or protocol
• action
• url, uri, http_user_agent, http_method, status
• user, src_user, dest_user
• app, app_category, vendor_product
• bytes, bytes_in, bytes_out

Extended Logging

• index, sourcetype, source, host
• Splunk ES notable event fields
• CIM Network_Traffic, Web, Authentication, and Alerts fields
• risk object and risk score
• MITRE tactic/technique fields
• correlation search name
• raw event body
• location and asset/identity enrichment

User And App Identity

• CIM user
• src_user, dest_user
• identity lookup-enriched fields
• app, app_category, vendor_product
• URL/host/domain fields

OTLP Mapping Notes

Map Splunk metadata into attributes such as splunk.index, splunk.sourcetype, splunk.source, and event.original. Keep CIM field names alongside vendor raw fields when possible.

Source

• OpenTelemetry Logs Data Model