> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpmanager.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk Observability Cloud

> Why MCP Manager cannot forward logs directly to Splunk Observability Cloud — it has no OTLP logs intake — and how to deliver logs instead using a self-hosted OpenTelemetry Collector that translates OTLP to Splunk HEC.

Splunk Observability Cloud is the one backend on this list that MCP Manager **cannot** forward logs to directly. This page explains why, and what to do instead.

<Warning>
  **Splunk Observability Cloud has no OTLP logs intake.** Its OTLP/HTTP endpoint accepts only **traces** (at `/v2/trace/otlp`) and **metrics** (at `/v2/datapoint/otlp`) — there is no `/v1/logs` equivalent. Because MCP Manager sends logs over OTLP/HTTP, it cannot deliver them to Splunk Observability Cloud directly. Use a [self-hosted OpenTelemetry Collector](/enterprise/export-to-siem/self-hosted-collector) in front to translate OTLP logs into Splunk's HEC format.
</Warning>

This page covers the Splunk-specific situation. For what MCP Manager sends and how forwarding behaves in general, see [Export to SIEM](/enterprise/export-to-siem).

## Why MCP Manager can't send logs directly

Splunk Observability Cloud's documented OTLP/HTTP exporter exposes only a traces endpoint and a metrics endpoint — there is no logs endpoint. In the Splunk product split, **logs** live in **Splunk Cloud Platform** (or Splunk Enterprise), not in Observability Cloud; Observability Cloud's **Log Observer Connect** feature *queries* those logs where they already reside rather than ingesting them over OTLP. Splunk's own logs ingestion path is the **HTTP Event Collector (HEC)**, for example `https://<host>:8088/services/collector`, which is a different protocol from OTLP.

The practical consequence: MCP Manager's single OTLP/HTTP logs forwarder has no Splunk Observability Cloud endpoint to target for logs.

## What to do instead: translate OTLP logs to HEC with a Collector

Run a [self-hosted OpenTelemetry Collector](/enterprise/export-to-siem/self-hosted-collector) that receives OTLP logs from MCP Manager and exports them to Splunk via the `splunk_hec` exporter. MCP Manager points at your Collector; your Collector translates and forwards to HEC.

```mermaid theme={null}
%%{init: {'theme':'base','themeVariables':{'fontFamily':'Lato, sans-serif','lineColor':'#6a6b76','primaryColor':'#e0e2e8','primaryTextColor':'#12141d','primaryBorderColor':'#6a6b76','edgeLabelBackground':'#ffffff','textColor':'#12141d'}}}%%
flowchart LR
    A["🛡️<br/>MCP Manager"] -->|OTLP/HTTP logs| B["🔌<br/>Your OpenTelemetry Collector"]
    B -->|splunk_hec exporter| C["🔌<br/>Splunk Cloud Platform HEC"]
    classDef gateway fill:#0086ff,color:#ffffff,stroke:#062b4c,stroke-width:2px;
    classDef external fill:#e0e2e8,color:#2c2c37,stroke:#9ca1ab,stroke-width:1px,stroke-dasharray:4 3;
    class A gateway;
    class B,C external;
```

In this setup:

* **MCP Manager → Collector** uses the OTLP/HTTP logs endpoint described in the [self-hosted Collector guide](/enterprise/export-to-siem/self-hosted-collector) (`https://<your-collector-host>:4318/v1/logs`).
* **Collector → Splunk** uses the `splunk_hec` exporter pointed at your HEC endpoint (`https://<host>:8088/services/collector`) with a HEC token.

This logs limitation does **not** apply to traces. MCP Manager now also exports request **traces** over OTLP/HTTP, and Splunk Observability Cloud *does* accept OTLP traces — so you can point the **Traces collector URL** at Splunk's trace endpoint (`https://ingest.<realm>.observability.splunkcloud.com/v2/trace/otlp`) with an `X-SF-Token` access-token header, no Collector required. Because MCP Manager sends OTLP/HTTP **JSON** and Splunk's trace intake documents protobuf, verify delivery before relying on it (and fall back to a self-hosted Collector if JSON is rejected). For **logs**, the Collector-to-HEC path above remains the only route.

## Find your realm

Every Splunk Observability Cloud host is realm-specific (for example `us0`, `us1`, `eu0`, `eu1`, `ap0`). Your realm determines the ingest host `https://ingest.<realm>.observability.splunkcloud.com`. Find your realm in the Splunk Observability Cloud UI before configuring any endpoint.

## Further reading

<CardGroup cols={2}>
  <Card title="Self-hosted Collector" icon="server" href="/enterprise/export-to-siem/self-hosted-collector">
    Stand up the Collector that receives OTLP logs and exports them to Splunk HEC.
  </Card>

  <Card title="Export to SIEM" icon="tower-broadcast" href="/enterprise/export-to-siem">
    What MCP Manager sends, how forwarding behaves, and general troubleshooting.
  </Card>
</CardGroup>

## External sources

<CardGroup cols={2}>
  <Card title="Splunk OTLP/HTTP exporter reference" icon="arrow-up-right-from-square" href="https://help.splunk.com/en/splunk-observability-cloud/manage-data/splunk-distribution-of-the-opentelemetry-collector/get-started-with-the-splunk-distribution-of-the-opentelemetry-collector/collector-components/exporters/otlphttp-exporter">
    Shows the `/v2/trace/otlp` and `/v2/datapoint/otlp` paths with `X-SF-Token` auth — and no logs endpoint.
  </Card>

  <Card title="Find your realm and API endpoints" icon="arrow-up-right-from-square" href="https://docs.splunk.com/observability/en/admin/references/organizations.html">
    How to find your realm, which determines every ingest host.
  </Card>

  <Card title="Introduction to Log Observer Connect" icon="arrow-up-right-from-square" href="https://docs.splunk.com/observability/logs/intro-logconnect.html">
    How Splunk queries logs that live in Splunk Cloud Platform rather than Observability Cloud.
  </Card>
</CardGroup>