TA-IPMI

TA-IPMI is a free, source-available Splunk add-on that brings out-of-band hardware health monitoring to any Splunk host with a server-class BMC. It reads full IPMI telemetry via ipmitool's local open interface and indexes it three ways with zero manual configuration: 1. Sensor readings: every SDR sensor (temperatures, fan RPM, voltages such as 12V/3.3V/Vcore/BAT, power draw in watts, plus thresholds), plus chassis and BMC status as rich JSON events (index=main, sourcetype ipmi:status) for fielded search. 2. The same readings as time-series metrics in index=metrics (sourcetype ipmi:metrics, ipmi.* measure names), so thermal, fan, voltage and power trends survive retention and answer in milliseconds with mstats. 3. The System Event Log (SEL): each SEL record indexed exactly once as a separate event with sensor, event type, assertion state and raw detail preserved, so BIOS-level crashes, power faults, ECC errors, fan failures and intrusion alerts become searchable Splunk events. Why it matters: IPMI/BMC is the only observability layer that survives OS crashes, power loss, and hangs. Overheating servers, dead fans, failing PSUs, dropped redundancy and unexpected reboots happen below the OS where agents and syslog can't follow, but the BMC remembers everything. TA-IPMI closes that blind spot in minutes: install it on the host, and its BMC telemetry flows into Splunk with ready-made overview and trend dashboards. Licensing: free for personal, evaluation, and non-commercial use. Commercial/production use requires a license from the author: michael@bentleypc.com. Source available at https://github.com/bentleymi/TA-IPMI