Splunk Observability Cloud

Splunk Observability Cloud is the one backend on this list that MCP Manager cannot forward logs to directly. This page explains why, and what to do instead. This page covers the Splunk-specific situation. For what MCP Manager sends and how forwarding behaves in general, see Export to SIEM.

​

Why MCP Manager can’t send logs directly

Splunk Observability Cloud’s documented OTLP/HTTP exporter exposes only a traces endpoint and a metrics endpoint — there is no logs endpoint. In the Splunk product split, logs live in Splunk Cloud Platform (or Splunk Enterprise), not in Observability Cloud; Observability Cloud’s Log Observer Connect feature queries those logs where they already reside rather than ingesting them over OTLP. Splunk’s own logs ingestion path is the HTTP Event Collector (HEC), for example https://<host>:8088/services/collector, which is a different protocol from OTLP. The practical consequence: MCP Manager’s single OTLP/HTTP logs forwarder has no Splunk Observability Cloud endpoint to target for logs.

​

What to do instead: translate OTLP logs to HEC with a Collector

Run a self-hosted OpenTelemetry Collector that receives OTLP logs from MCP Manager and exports them to Splunk via the splunk_hec exporter. MCP Manager points at your Collector; your Collector translates and forwards to HEC. In this setup:

• MCP Manager → Collector uses the OTLP/HTTP logs endpoint described in the self-hosted Collector guide (https://<your-collector-host>:4318/v1/logs).
• Collector → Splunk uses the splunk_hec exporter pointed at your HEC endpoint (https://<host>:8088/services/collector) with a HEC token.

This logs limitation does not apply to traces. MCP Manager now also exports request traces over OTLP/HTTP, and Splunk Observability Cloud does accept OTLP traces — so you can point the Traces collector URL at Splunk’s trace endpoint (https://ingest.<realm>.observability.splunkcloud.com/v2/trace/otlp) with an X-SF-Token access-token header, no Collector required. Because MCP Manager sends OTLP/HTTP JSON and Splunk’s trace intake documents protobuf, verify delivery before relying on it (and fall back to a self-hosted Collector if JSON is rejected). For logs, the Collector-to-HEC path above remains the only route.

​

Find your realm

Every Splunk Observability Cloud host is realm-specific (for example us0, us1, eu0, eu1, ap0). Your realm determines the ingest host https://ingest.<realm>.observability.splunkcloud.com. Find your realm in the Splunk Observability Cloud UI before configuring any endpoint.

​

Further reading

​

External sources