Splunk O11y Cloud Explained: Log Observer Connect

In this video, we explore the capabilities of Log Observer Connect within the Splunk Observability Cloud. We begin by navigating through the service map, where we identify a performance issue with our payment service. By clicking on the service, we seamlessly transition into Log Observer, allowing us to view logs pertinent to the specific time window of the incident. Utilising Log Observer, we can quickly visualise real-time metrics and logs without needing to write any code. The interface presents us with a comprehensive logs table and a field sidebar that facilitates intuitive filtering. As we delve into the logs, we apply filters to narrow down our search by severity and application version, revealing a notable correlation between errors and the recently deployed version of our application, 350.10.

As the demonstration unfolds, we leverage the grouping feature to further analyse the logs, confirming that all error events are associated with this new version. We find that the logs indicate failed payments due to an invalid API token, prompting us to consider rolling back to the previous version, 350.9, which is free of errors. This action will restore functionality for our users and address the reported issues. In summary, Log Observer Connect empowers teams to swiftly identify and resolve issues by providing context-rich insights into logs and metrics. This capability enhances operational efficiency and ensures that organisations can maintain optimal performance across their applications.