Splunk Observability Integration

ULTIMATE

Feature Preview: This feature is available for Ultimate subscribers as a subscription add-on and may incur additional charges.

The Splunk Observability Integration streams logs from all apps into your Splunk account for seamless observability.

Offered as an add-on feature, this backend integration enables monitoring from external systems, faster troubleshooting, and unified visibility across your application ecosystem.

Key Capabilities

1. Platform-Level Integration

Available as an optional add-on at the platform level
Automatically captures and streams monitoring data of all deployed apps

2. Application Log Streaming

Streams application logs in near real-time to Splunk.
Includes records generated at the application layer for debugging and troubleshooting, including:
- Log output of apps ranging from various levels, including errors, warnings, info and audit logs (optional).
- Run output of apps that represent the execution sequence of a flow (optional).
- Job events of apps generated by checkpoints of a flow (optional).
Enables:
- Centralized log aggregation
- Advanced search, filtering, and analytics
- Faster root cause analysis

→ Splunk log management allows teams to collect, process, and analyze large volumes of log data efficiently.

How It Works

Apps generate logs
qibb Platform automatically collects log data
Data is streamed to Splunk ingestion endpoints
Splunk processes and visualizes the data in dashboards

This integration provides log streaming for Splunk.

Creation and management of dashboards, monitors, alerts, retention policies, and Splunk resources remain the responsibility of the customer.

Log Data Fields

Below are the most common data fields included in the records. Most fields are optional. Data fields may vary by app or platform version.

Category	Field	Description	Example
Time	timestamp	Timestamp of the record.	`1779111812501`
Log type	type	If empty: Log record. If “`run`”: Run record If “`job_event`”: Event record for a job.	-
Log Information	level	Log level, e.g. `info`, `debug`, `audit`, `warn`, `error`	`info`
	stream	Log output stream, e.g. `stdout` or `stderr`	`stdout`
	message	The log message	`The next execution time of Auto Retry task is scheduled for **********.`
App Information	qibb_appId	Id of the app.	`xmtwhy*******`
	container	The component of the app. Either `flow-app-container` (primary component that powers the low-code workflow engine which runs flow) or `flow-app-sidecar` (secondary component whic is responsible Management API processing and background tasks for jobs).	`flow-app-container`
	qibb_spaceId	Id of the space which contains this app.	`of1****`
Flow Information	flow_id	Id of the flow tab.	`abc*************`
Node Information	node_id	If of the node.	`xy5df3**********`
	node_type	Node type	`qibb-checkpoint`
	node_name	Node name	`Checkpoint`
Flow Message Information (msg)	msg_id	Id of the processed msg object.	`71ccf2bc59******`
Run Information	run_id	Id of the run.	`yy77WVc1mNJFbu*******`
Job Information	job_id	If of the job.	`a3rL4ptjpDCVj0v******`
	msg	Only applicable if type=job_event. A JSON containing event metadata. Typically includes: job_id, event, checkpoint_id, checkpoint_name, checkpoint_type, summary_plain_text	`{ "checkpoint_name":"Wait for approval", "queue_type":"WAIT", "job_id":"eh74L84596Vt3eG***", "checkpoint_id":"ae5df382911***", "checkpoint_type":"WAIT", "event_level":"INFO", "summary_plain_text":"Wait for approval: Job awaits approval.", "type":"job_event", "event":"WAIT", "attempt":0, "timestamp":"2026-05-18T13:43:32.501Z" }`
Infrastructure	qibb_cluster_id	Id of the cluster which is hosting this app.	`clx**********`