Splunk Firehose Nozzle for PCF

This documentation describes the Splunk Nozzle for Pivotal Cloud Foundry (PCF) Firehose. Splunk Nozzle integrates with PCF Loggregator and forwards streaming logs and metrics from user apps and system components of Cloud Foundry to Splunk Enterprise. PCF operators can then gain operational visibility over their PCF infrastructure, including the health and performance of their apps and system components.


The Splunk Firehose Nozzle for PCF Tile streams logs and metrics from PCF and forwards them to user-specified Splunk Enterprise indexers configured to receive data via HTTP Event Collector. PCF operators and Splunk users can immediately search and analyze PCF Firehose data from their Splunk Enterprise deployment to build reports, dashboards, and alerts on the health and performance of their apps.

Splunk Firehose Nozzle for PCF includes the following key features:

  • Setup with out-of-the-box data parsing and enrichment for various PCF event types.
  • Reliable event delivery by leveraging Splunk’s HTTP Event Collector endpoint.
  • Secure forwarding from PCF into external Splunk environments using user-provided SSL certificates.
  • Scales out to meet increasing data volume and number of apps.

Product Snapshot

Element Details
Tile Version v1.0.2
Release Date February 27th, 2019
Compatible Ops Manager Version(s) v2.1.x, v2.2.x, v2.3.x, and v2.4.x
Compatible Pivotal Application Service (formerly known as Elastic Runtime) version(s) v2.1.x, v2.2.x, v2.3.x, and v2.4.x
BOSH stemcell version Ubuntu Xenial
IaaS Support vSphere, OpenStack, and AWS

WARNING: Splunk Nozzle for PCF v1.0.1 and earlier require a Ubuntu Trusty stemcell. The end-of-life date for Ubuntu Trusty is April 2019. If a security vulnerability is found on this stemcell after April, it will not be fixed.


Splunk Firehose Nozzle for PCF has the following requirements.

  • An external Splunk Enterprise or Splunk Cloud 6.x deployment configured with a HTTP Event Collector token to receive data.

Splunk and the PCF Ecosystem

There are currently many projects involving Splunk and Pivotal Cloud Foundry. Included are links to these projects:


No known limitations.


Please provide any bugs, feature requests, or questions to the Pivotal Cloud Foundry Feedback or to Splunk via the github project page.

Create a pull request or raise an issue on the source for this page in GitHub