Scaling Enterprise Observability with the Splunk OpenTelemetry Collector

Enterprise systems span decades of technology: business-critical applications on Linux and Windows, middleware and network equipment, virtual machines, and cloud-native services running in Kubernetes. Each produces operational signals, but those signals often arrive through separate agents and pipelines. That fragmentation makes it difficult to see how the full environment is performing.

The Splunk Distribution of the OpenTelemetry Collector provides a common, open-standard way to collect, process, and route telemetry across those systems. It supports configurable pipelines for logs, metrics, traces, and metadata, helping teams extend observability across the environments they operate.

Bring Traditional Systems Into View

Traditional infrastructure remains central to enterprise services. The Collector can gather host metrics and logs from Linux and Windows systems, including Linux files, journald, audit logs, and syslog, as well as Windows Event Logs, IIS, and Active Directory Domain Services. It also supports native log ingestion into Splunk Platform over OTLP, giving teams a standards-based path to collect host logs through the Collector.

Visibility can reach deeper into the systems that support business services. Depending on the configured receivers and integrations, teams can collect telemetry from IBM MQ, monitor time services such as PTP and NTP, and receive network data through gNMI or YANG/gRPC. These sources bring middleware, time synchronization, and network infrastructure into the same observability practice as applications and hosts. Splunk's Collector component documentation includes a YANG/gRPC receiver, and its NTP integration collects clock offset metrics.

Extend the Same Approach to Cloud-Native and AI Systems

In Kubernetes environments, the Collector can gather metrics, traces, logs, and events from clusters and workloads. Application instrumentation can send telemetry through OTLP, providing context about requests as they move between services.

AI-powered applications and agents add another important source of signals. When applications are instrumented to emit them, traces and metrics can include model calls, token usage, latency, tool invocations, and agent decision paths. Collecting these alongside application and infrastructure telemetry helps teams understand AI performance and usage in context.

Scale With a Consistent Collection Model

As environments grow, teams need a repeatable way to onboard systems without creating a separate collection approach for every platform. The Collector's receiver, processor, and exporter model gives teams a shared framework: receivers gather data, processors can enrich or filter it, and exporters route it to the appropriate destination.

Teams can deploy Collectors close to hosts and services or use gateway deployments to forward telemetry. They can apply consistent conventions across traditional and cloud-native environments while tailoring pipelines to the signals each system provides. This helps reduce reliance on disconnected tools and makes it easier to extend coverage as infrastructure evolves.

Connect Signals To Understand System Behavior

Logs, metrics, and traces each show a different part of system behavior. Bringing them into connected pipelines helps teams investigate incidents with more context, see where performance is degrading, and understand how issues move across service and infrastructure boundaries.

With the Splunk Distribution of the OpenTelemetry Collector, enterprises can build observability across traditional architectures, cloud-native platforms, and AI-powered services using a common open-standard collection layer. That gives teams a practical foundation for expanding coverage across their systems while retaining flexibility in how telemetry is processed and routed.

We’re Looking for Feedback!

Want to talk about OpenTelemetry? Join Antoine Toulme, Product Manager and OpenTelemetry Maintainer, and me, every Monday at 8:30 a.m. PT/11:30 a.m. ET for Observability HQ when we lead and OpenTelemetry drop-in. You can also meet us and the other Splunk OTel maintainers and contributors at Kubecon North America in Salt Lake City in November.

Pop into an Observability HQ and we’ll give you a 20% off discount code for Kubecon!