Compatibility

Splunk dashboards, Universal Forwarders, testing on your own environment, HEC integration, Splunk Enterprise on-premises, and Splunk Cloud Platform.

Does 10x work with my existing Splunk dashboards and queries

Yes. Compact events keep host, source and index; their sourcetype is tenx_encoded, the one the app expands, and field extractions apply to the expanded text.

Fields preserved:

  • host, source, index
  • sourcetype, set to tenx_encoded by the HEC token
  • _raw, expanded at search time
  • Field extractions, applied to the expanded text

_time on a compact event is the time in its original line wherever the template has a timestamp, and the time Splunk indexed it otherwise.

How searches reach compact events:

  • Classic dashboards in an app that carries dashboard.js keep their SPL unchanged; Dashboard Studio panels use tx
  • The search bar, saved searches and the REST API start the search with the tx command, naming the compact sourcetype: | tx index=app_logs sourcetype=tenx_encoded error
  • Alerts created in the Compile Alert view are compiled once at save time, so they run natively server-side; an alert saved from the search page starts with | tx

How optimization works: The 10x Engine uses template-based encoding, keeping every value. Each repeated log event is replaced by a compact reference to its template while maintaining full searchability in Splunk. Splunk stores a compact event whole up to 256 KB; the app's size limit covers longer events.

Does this work with Universal Forwarders

Yes. The 10x Receiver runs as a file relay in front of Universal Forwarders: Fluent Bit with 10x reads the app's log folder, optimizes, and writes to a second folder the Universal Forwarder monitors. The Reporter deploys as a DaemonSet alongside them.

Fluent Bit with 10x reads the app's logs, optimizes, and writes them to a second folder. The Universal Forwarder tails that folder with its standard inputs.conf and ships to the indexers over S2S. Forwarding directly to Splunk HEC is a separate option, not part of the Universal Forwarder relay.

Compatibility: Universal Forwarder 8.x, 9.x, 10.x. The forwarder's inputs.conf monitor stanza points at the folder 10x writes instead of the app's log folder; the rest of its configuration stays as it is. Works with existing HEC endpoints and token authentication.

How do I test this on my Splunk environment
  1. Cost POC, install the 10x MCP and ask it to run a POC on your Splunk logs. The engine runs on your own machine, results in minutes. No account, no credit card.
  2. Reporter, Deploy as a DaemonSet alongside your forwarder for cost visibility before logs reach Splunk. Alternatively, the MCP server's SIEM-sample tool connects to Splunk via REST API for agentless Splunk-side analysis (no DaemonSet).
  3. Receiver, Deploy via Helm chart alongside your forwarder. Filter mode (sampling) or Compact mode (lossless shrink via the Log10x App). ~30 min setup.
  4. Retriever, Route events to S3, stream selected data to Splunk on-demand.

Each step is independent, start with the cost POC to see your reduction ratio, then move to production when ready.

How does this integrate with Splunk HEC

The 10x Engine sits between your log forwarder and Splunk HEC:

App → Fluentd/UF → 10x Receiver (Compact mode) → Splunk HEC → Indexer

Execution (Receiver):

  • Runs as a file relay in front of the Universal Forwarder, or as a sidecar container with Fluentd or OTel
  • Filters (lossy) or compacts (lossless up to 256 KB per event) logs in-memory before forwarding to HEC
  • Uses standard HEC token authentication
  • Can also forward via splunktcp to indexers (standard UF protocol)

Observability (Reporter):

  • Deploys as a DaemonSet alongside your forwarder (logs never pass through it)
  • Emits pre-ingestion cost insight metrics to the time-series backend you configure (Prometheus, Datadog, CloudWatch, Elastic)
  • Fails independently, logs continue flowing to Splunk if Reporter goes down

Fetching from S3:

  • Retriever routes events to your own S3 and returns the exact offloaded events to HEC on-demand

Agentless Splunk analysis: The MCP server's SIEM-sample tool queries Splunk REST API for cost analysis without deploying a DaemonSet.

Compatibility: The Receiver and Reporter send to any Splunk HEC endpoint, on Splunk Cloud Platform or Splunk Enterprise. No changes to HEC configuration required. The Log10x App, which expands compact events, supports Splunk Enterprise 9.4 through 10.6.

Works with Splunk Enterprise on-premises

Yes. The Receiver, Reporter and Retriever work with Splunk Enterprise on-premises across single-instance, distributed, and clustered deployments. The Log10x App supports Splunk Enterprise 9.4 through 10.6.

On-premises, the Receiver sidecar and Reporter DaemonSet forward to HEC or to Heavy Forwarders, using either HEC token or Heavy Forwarder S2S authentication.

Agentless Splunk analysis via log10x-mcp for on-premises:

  • SIEM-sample tool queries Splunk Enterprise REST API
  • Requires admin or power user credentials
  • Runs wherever you run an MCP server (workstation, CI, infrastructure)
  • No data egress to external systems

Retriever for on-premises: Works with AWS S3, Azure Blobs, and any S3-compatible object storage. Returns the exact offloaded events to Splunk Enterprise HEC endpoints on-demand.

Does the Log10x App run on Splunk Cloud Platform

The Log10x App is tested on Splunk Enterprise 9.4, 10.0, 10.2, 10.4 and 10.6, and the package passes AppInspect's Splunk Cloud checks. On Splunk Cloud Platform, an uploaded app goes through Splunk's own vetting before it installs.

Setup is the same on both: install the app, create the tenx_dml index and two HEC tokens, point the Receiver at them, set the tenx-events macro, and run the backfill search once if templates were indexed before the app. The app creates its KV Store collection itself. See the Quickstart.

The app runs Python on the search head: the tx and tenxsearch commands, the /tenx-search and /tenx-alert endpoints, and the alert action that stores templates. It makes no outbound calls.