## SOURCES: Data sources that Observability Pipelines Worker collects data from.
## For a Splunk use case, we are receiving data from a Splunk index.
sources:
  splunk_receiver:
    type: splunk_hec
    address: 0.0.0.0:8088
    valid_tokens:
        - ${SPLUNK_TOKEN}

transforms:
  ## This is a placeholder for your own remap (or other transform)
  ## steps with tags set up. Datadog recommends these tag assignments.
  ## They show which data has been moved over to OP and what still needs
  ## to be moved.
  logs_enrich:
    type: remap
    inputs:
      - splunk_receiver
    source: |
      .sender = "observability_pipelines_worker"
      .opw_aggregator = get_hostname!()

## This buffer configuration is split into 144GB buffers for both of the Datadog and Splunk sinks.
##
## This should work for the vast majority of OP Worker deployments and should rarely
## need to be adjusted. If you do change it, be sure to update the size of the persistence
## block above.
##
## The "${DD_API_KEY}", "${SPLUNK_HEC_ENDPOINT}", and "${SPLUNK_TOKEN}" parameters are automatically replaced
## by the settings you provisioned earlier.
sinks:
  datadog_logs:
    type: datadog_logs
    inputs:
      - logs_enrich
    default_api_key: "${DD_API_KEY}"
    site: "${DD_SITE}"
    compression: gzip
    buffer:
        type: disk
        max_size: 154618822656
  splunk_logs:
    type: splunk_hec_logs
    inputs:
      - logs_enrich
    endpoint: ${SPLUNK_HEC_ENDPOINT}
    default_token: ${SPLUNK_TOKEN}
    encoding:
      codec: json
    buffer:
        type: disk
        max_size: 154618822656
