This guide configures an OpenTelemetry Collector running in Kubernetes to ingest /var/log/auth.log from a Linux node and forward it to Splunk through the HTTP Event Collector (HEC).
The resulting Splunk events use:
index=monitoring
sourcetype=linux:auth
source=/var/log/auth.log
host=host1.example.com




