icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Metrics Add-on for Infrastructure
SHA256 checksum (metrics-add-on-for-infrastructure_116.tgz) 995f5ebaa36134f703240bd2f7f2dcefdb00c6aeb95ff7fc11569cbb2a3df516 SHA256 checksum (metrics-add-on-for-infrastructure_115.tgz) 1c573b305b9d987c1880a47eaa6df52e97c3bc1d917c6a7a1b9cce7d989845bc SHA256 checksum (metrics-add-on-for-infrastructure_112.tgz) 9758f94cc15383bf01975cc478e1a2497faf3d0fc5f3dcfd9e9a0fbb4acfcd38 SHA256 checksum (metrics-add-on-for-infrastructure_111.tgz) b9b0e50dfa82e57929afeb3f43ee8fc6c4af710557d71b99478581bed5225b5c SHA256 checksum (metrics-add-on-for-infrastructure_110.tgz) 85d191376a9967d6423d5bca53b71efb6321effe2a6391627c8436d30bd05313 SHA256 checksum (metrics-add-on-for-infrastructure_103.tgz) 425037da8440e6e59e3910225f06b1938cd4026009bdc53196a84d9ee99e8e20 SHA256 checksum (metrics-add-on-for-infrastructure_102.tgz) 344492956378bb36f9c0ac834df84fb61e0cb95a7edebca0829590af3819b812 SHA256 checksum (metrics-add-on-for-infrastructure_101.tgz) 3077da33b122a3fe86aafa2681beec38765f7969e4ed0822adb7813179e1189a SHA256 checksum (metrics-add-on-for-infrastructure_100.tgz) b8ecfe0d057d1627b0aa0119b9fbce1444db86e33c965bf24b10cc67e05ee598
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Metrics Add-on for Infrastructure

Splunk Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
The Metrics Add-on for Infrastructure (TA-linux-metrics) can be used on Linux Forwarders to send Operating System metrics to Splunk without using collectd or the HTTP Event Collector (HEC) and it is fully compatible with the "Splunk App for Infrastructure" :-
https://splunkbase.splunk.com/app/3975/

One of the most powerful features of the add-on is the ability to add custom dimensions to each metric, e.g. cloud, region, dc, & environment.

Please read the "Details" tab for installation instructions.

Katana1 Built:
https://katana1.com

The Metrics Add-on for Infrastructure (TA-linux-metrics) can be used on Linux Forwarders to send Operating System metrics to Splunk without using collectd or the HTTP Event Collector (HEC) and it is fully compatible with the "Splunk App for Infrastructure":
https://splunkbase.splunk.com/app/3975/

Note: the output is formatted for multiple-measurement metric data points (Splunk v8.x only) which allows for significant license savings as a single metric data point can now contain multiple measurements and dimensions.

One of the most powerful features of the add-on is the ability to add custom dimensions to each metric.

Use the built-in Setup Page to configure the inputs on a Standalone Instance, or use a Deployment Server to push the add-on to your forwarders.

Compatibility

  • Splunk Enterprise v8.x
  • Splunk Universal Forwarder v8.x
  • Splunk App for Infrastructure v2.x
  • Linux: Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Amazon Linux, CentOS 6, CentOS 7, CentOS 8, RHEL 6, RHEL 7, RHEL 8

Metrics

  • CPU
  • Memory
  • Swap
  • Load
  • Uptime
  • Filesystems
  • Inodes
  • Disk I/O
  • Interfaces
  • Processes

Custom Dimensions

You can configure the following custom dimensions and they will be added to all of the metrics as above:

  • cloud
  • region
  • dc
  • environment

Installation

  • Create a new 'metric' index on your indexer/s, e.g. metrics_linux

Example indexes.conf :-

[metrics_linux]
coldPath = $SPLUNK_DB/metrics_linux/colddb
homePath = $SPLUNK_DB/metrics_linux/db
thawedPath = $SPLUNK_DB/metrics_linux/thaweddb
datatype = metric
  • Install the add-on on your Linux servers and enable the inputs. Either use the built-in Setup Page, or copy the input stanzas from the default directory to the local directory (i.e. local/inputs.conf) and enable them as required:

    • Update: disabled = 0
    • Update: index = metrics_linux
    • Note: DO NOT UPDATE sourcetype = metrics_csv
  • If you enable process monitoring, configure the relevant processes to monitor for your environment. Copy the stanza from the default directory to the local directory (i.e. local/process_mon.conf) and configure them as required:

        [process_mon]
        allowlist = bash,zsh,sshd,python.*
        blocklist = splunkd
    
    • Note: allowlist and blocklist should be comma separated without spaces
  • Configure the relevant dimensions for your environment. Copy the dimensions from the default directory to the local directory (i.e. local/dims.conf) and configure them as required:

    • Note: you can set cloud to aws or gcp and the built-in scripts will auto-discover the Region and Availablity Zone of the instance, e.g.

      [all]
      cloud = gcp
      
    • Shell environment variables are also supported, e.g.

      [all]
      environment = $Deploy_Environment
      
    • Note: the region and dc do not need to be configured if cloud is aws or gcp, i.e. only set these dimensions if cloud = false

  • Install the "Splunk App for Infrastructure" on your Search Head

Troubleshooting

  • If you don't see any Entities under 'Investigate' in the Splunk App for Infrastructure :-

    • Update the 'sai_metrics_indexes' macro in the Splunk App for Infrastructure, e.g. index=metrics_linux
  • Error when enabling inputs via the Setup Page:

    Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/TA-linux-metrics/data/inputs/script/.%252Fbin%252Fcpu_usage.sh
    
    • Create a new 'metric' index before you enable any inputs
  • Run the following search to confirm that metrics are being indexed :-

    | mcatalog values(metric_name)
    
  • If you see similar errors to the following in 'splunkd.log' on the forwarder :-

    11-10-2020 16:26:45.553 +1100 WARN  IndexProcessor - The metric name is missing for source=/opt/splunk/etc/apps/TA-linux-metrics/bin/cpu_usage.sh, sourcetype=cpu_usage, host=foo, index=metrics_linux. Metric event data without a metric name is invalid and cannot be indexed. Ensure the input metric data is not malformed. raw=["_time","metric_name:cpu.user","metric_name:cpu.system","metric_name:cpu.nice","metric_name:cpu.idle","metric_name:cpu.wait","metric_name:cpu.interrupt","metric_name:cpu.softirq","metric_name:cpu.steal","model","cloud","region","dc","environment","ip","os","os_version","kernel_version"]
    
    11-10-2020 16:26:45.553 +1100 WARN  IndexProcessor - The metric value=<unset> is not valid for source=/opt/splunk/etc/apps/TA-linux-metrics/bin/cpu_usage.sh, sourcetype=cpu_usage, host=foo, index=metrics_linux. Metric event data with an invalid metric value cannot be indexed. Ensure the input metric data is not malformed. raw=["_time","metric_name:cpu.user","metric_name:cpu.system","metric_name:cpu.nice","metric_name:cpu.idle","metric_name:cpu.wait","metric_name:cpu.interrupt","metric_name:cpu.softirq","metric_name:cpu.steal","model","cloud","region","dc","environment","ip","os","os_version","kernel_version"]
    
    • Ensure that the sourcetype is set to metrics_csv and your forwarder is at least v8.x
  • If you have set "allowlist = " to monitor all processes but the "process_usage.sh" script uses 100% CPU and takes a long time to run, you may have hit a $PATH bug in one of your system profile scripts :-

    • Set the file mode on the script as follows, e.g.
      # sudo chmod 0750 /etc/profile.d/jdk.sh
      

Katana1 Built

  • https://katana1.com

    • Developer:

      • Luke Harris (Data Analytics Practice Lead)
    • Contributors:

      • Chris Barbour
      • Robin Pollard

Release Notes

Version 1.1.6
March 2, 2021

Bug Fix: removed unnecessary tail command from process_total.sh

Version 1.1.5
March 2, 2021

Optimized process_total.sh, df_usage.sh, & df_inodes.sh to use a subshell instead of a temp file

Version 1.1.2
Feb. 18, 2021

Optimized process_usage.sh to use arrays instead of a temp file

Version 1.1.1
Nov. 18, 2020

Added Inode Usage to the Setup page.

Version 1.1.0
Nov. 17, 2020

Process monitoring now uses allowlist & blocklist, Updated df usage to use -P option (POSIX compliant), Added new input for df inode usage, and bug fixes.

Version 1.0.3
Jan. 30, 2020

* Fixed script to source Shell Environment Variables

Version 1.0.2
Jan. 28, 2020

* Bug Fixes

Version 1.0.1
Jan. 24, 2020

* Updated the Setup Page
* Updated image icons
* Updated default whitelist for Process Monitoring
* Added "noproxy" option to aws and gcp scripts
* Various bug fixes

Version 1.0.0
Jan. 21, 2020

Initial Release

73
Installs
774
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.