Using the Splunk Observability Cloud events integration

Overview

This topic explains how to use the LaunchDarkly Splunk Observability Cloud integration.

Splunk Observability Cloud can detect and alert engineers when their applications are trending in an unstable direction. In doing so, these engineers will likely want to identify what changed and caused the application to become unstable. One potential cause could be the toggling of a feature flag. The LaunchDarkly Splunk Observability Cloud integration works to streamline this use case by exposing flag change data to Splunk Observability Cloud.

With clear data markers representing feature flag changes, Splunk Observability Cloud users can more easily correlate their feature flag rollouts with changes in operational health.

Prerequisites

To configure the Splunk Observability Cloud integration to send LaunchDarkly data to Splunk Observability Cloud, you must have the following prerequisites:

• Splunk Observability Cloud access token: This token authenticates your LaunchDarkly account to send data to your Splunk Observability Cloud account. To learn more about about working with Splunk Observability Cloud access tokens, read Splunk's documentation.
• Splunk Observability Cloud realm: The realm identifies the self-contained deployment of Splunk Observability Cloud that hosts your organization. Find the name of your organization's realm on your Splunk Observability Cloud profile page.

Configuring the Splunk Observability Cloud integration

Here's how to configure the Splunk Observability Cloud integration:

1. Navigate to the Integrations page page and find "Splunk Observability Cloud."
2. Click Add integration. The "Create Splunk Observability Cloud configuration" panel appears.
3. (Optional) Enter a human-readable Name.
4. Paste in your Splunk Observability Cloud access token.
5. Paste in your Splunk Observability Cloud realm.
6. (Optional) Configure a custom policy to control which flag information LaunchDarkly sends to Splunk Observability Cloud. To learn more about this option, read Advanced configuration.
7. After reading the Integration Terms and Conditions, check the I have read and agree to the Integration Terms and Conditions checkbox.
8. Click Save configuration.

When you configure the integration correctly, LaunchDarkly sends flag change data to Splunk Observability Cloud.

Advanced configuration

The "Policy" configuration field allows you to control which kinds of LaunchDarkly events are sent to Splunk Observability Cloud. The default policy value restricts it to flag changes in production environments:

proj/*:env/production:flag/*
COPY

Reasons to override the default policy include wanting to restrict the integration to:

• a specific combination of LaunchDarkly projects/environments
• a specific action (or set of actions)

For example, setting the policy configuration to the following will restrict LaunchDarkly such that only changes from the web-app project's production environment are sent to Splunk Observability Cloud:

proj/web-app:env/production:flag/*
COPY

To learn more about setting custom policies, read Policies in custom roles.

Using the integration

After you configure the integration, Splunk Observability Cloud charts are annotated with LaunchDarkly flag changes.

To learn more, read Splunk Observability Cloud's documentation.