Overview
This tutorial will guide you through creating a control in Splunk Agent Observability. By the end of this guide, you’ll know how to create, configure, and attach a control to meet your guardrail needs.Before you begin
If you want to use a control, you must attach it to an Agent Stream within a project. If you haven’t created a project with an Agent Stream, see Creating a project and Instrumentation. This tutorial assumes that:- You have installed the dependencies for Agent Control.
- You are familiar with Agent Control concepts. See Overview for more information.
Create a control from the user interface
1
Log into Splunk Agent Observability
Navigate to your Splunk Agent Observability homepage and log in.
2
Navigate to the Controls dashboard
In the Splunk Agent Observability main menu, select Controls, then Create new control.
3
Select the control type
Choose an evaluator type for your control.Evaluators receive data from your agent and check the data against configured rules. The evaluator you select controls your agent workflow Agent Control supports built-in and custom evaluators. See Overview for more information about the supported evaluators.
4
Configure the control
Add configurations to meet your guardrail needs.The following table describes the configuration fields:
For more information about the configuration fields, see Built-in Evaluators.
5
Save the control
Select Save to register the control.
6
Add the control to an Agent Stream within a project
In the Splunk Agent Observability main menu, select your Agent Stream. Select the Controls tab, then select Add control.A table displays with the available controls. Select Add next to your control.The control should appear in the table on the Controls tab for your project. The control takes effect immediately if your agent application is running. No redeployment is needed.
Attaching a control to an Agent Stream creates a clone of the control.Updating the clone doesn’t update the control for any other Agent Stream that uses the same control. Updating the global control in the Controls dashboard doesn’t update any existing clones.