Splunk Observability Cloud

Why MCP Manager cannot forward logs directly to Splunk Observability Cloud — it has no OTLP logs intake — and how to deliver logs instead using a self-hosted OpenTelemetry Collector that translates OTLP to Splunk HEC.

Splunk Observability Cloud is the one backend on this list that MCP Manager cannot forward logs to directly. This page explains why, and what to do instead.

Splunk Observability Cloud has no OTLP logs intake. Its OTLP/HTTP endpoint accepts only traces (at /v2/trace/otlp) and metrics (at /v2/datapoint/otlp) — there is no /v1/logs equivalent. Because MCP Manager sends logs over OTLP/HTTP, it cannot deliver them to Splunk Observability Cloud directly. Use a self-hosted OpenTelemetry Collector in front to translate OTLP logs into Splunk’s HEC format.

This page covers the Splunk-specific situation. For what MCP Manager sends and how forwarding behaves in general, see Export to SIEM.

Why MCP Manager can’t send logs directly

Splunk Observability Cloud’s documented OTLP/HTTP exporter exposes only a traces endpoint and a metrics endpoint — there is no logs endpoint. In the Splunk product split, logs live in Splunk Cloud Platform (or Splunk Enterprise), not in Observability Cloud; Observability Cloud’s Log Observer Connect feature queries those logs where they already reside rather than ingesting them over OTLP. Splunk’s own logs ingestion path is the HTTP Event Collector (HEC), for example https://<host>:8088/services/collector, which is a different protocol from OTLP.

The practical consequence: MCP Manager’s single OTLP/HTTP logs forwarder has no Splunk Observability Cloud endpoint to target for logs.

What to do instead: translate OTLP logs to HEC with a Collector

Run a self-hosted OpenTelemetry Collector that receives OTLP logs from MCP Manager and exports them to Splunk via the splunk_hec exporter. MCP Manager points at your Collector; your Collector translates and forwards to HEC.

In this setup:

• MCP Manager → Collector uses the OTLP/HTTP logs endpoint described in the self-hosted Collector guide (https://<your-collector-host>:4318/v1/logs).
• Collector → Splunk uses the splunk_hec exporter pointed at your HEC endpoint (https://<host>:8088/services/collector) with a HEC token.

If you only need MCP Manager traces or metrics in Splunk Observability Cloud you could target its /v2/... OTLP endpoints with an X-SF-Token access token — but MCP Manager forwards logs, so for MCP Manager the Collector-to-HEC path above is the route that applies.

Find your realm

Every Splunk Observability Cloud host is realm-specific (for example us0, us1, eu0, eu1, ap0). Your realm determines the ingest host https://ingest.<realm>.observability.splunkcloud.com. Find your realm in the Splunk Observability Cloud UI before configuring any endpoint.

Further reading

Self-hosted Collector

Stand up the Collector that receives OTLP logs and exports them to Splunk HEC.

Export to SIEM

What MCP Manager sends, how forwarding behaves, and general troubleshooting.

External sources

Splunk OTLP/HTTP exporter reference

Shows the /v2/trace/otlp and /v2/datapoint/otlp paths with X-SF-Token auth — and no logs endpoint.

Find your realm and API endpoints

How to find your realm, which determines every ingest host.

Introduction to Log Observer Connect

How Splunk queries logs that live in Splunk Cloud Platform rather than Observability Cloud.