icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Metrics Add-on for Infrastructure
SHA256 checksum (metrics-add-on-for-infrastructure_103.tgz) 425037da8440e6e59e3910225f06b1938cd4026009bdc53196a84d9ee99e8e20 SHA256 checksum (metrics-add-on-for-infrastructure_102.tgz) 344492956378bb36f9c0ac834df84fb61e0cb95a7edebca0829590af3819b812 SHA256 checksum (metrics-add-on-for-infrastructure_101.tgz) 3077da33b122a3fe86aafa2681beec38765f7969e4ed0822adb7813179e1189a SHA256 checksum (metrics-add-on-for-infrastructure_100.tgz) b8ecfe0d057d1627b0aa0119b9fbce1444db86e33c965bf24b10cc67e05ee598
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Metrics Add-on for Infrastructure

Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
TA-linux-metrics can be used on Linux Forwarders to send Operating System metrics to Splunk without using collectd or the HTTP Event Collector (HEC) and it is fully compatible with the "Splunk App for Infrastructure" (https://splunkbase.splunk.com/app/3975/)

Please read the "Details" tab for installation instructions.

Katana1 Built
https://katana1.com

TA-linux-metrics can be used on Linux Forwarders to send Operating System metrics to Splunk without using collectd or the HTTP Event Collector (HEC) and it is fully compatible with the "Splunk App for Infrastructure":
https://splunkbase.splunk.com/app/3975/

Note: the output is formatted for multiple-measurement metric data points (new to Splunk v8) which allows for reduced Splunk License consumption as a single metric data point can now contain multiple measurements and multiple dimensions.

Use the built-in Setup Page to configure the inputs on a Standalone Instance, or use a Deployment Server to push the add-on to your forwarders.

Compatibility

  • Splunk Enterprise v8.0.x
  • Splunk Universal Forwarder v8.0.x
  • Splunk App for Infrastructure v2.0.x
  • Linux: Ubuntu 16.04, Ubuntu 18.04, CentOS 7, CentOS 8, Amazon Linux, RHEL 7, RHEL 8

Metrics

  • CPU
  • Memory
  • Swap
  • Load
  • Uptime
  • Filesystems
  • Disk I/O
  • Interfaces
  • Processes
  • Docker (Coming Soon)

Dimensions

  • cloud
  • region
  • dc
  • environment
  • host
  • ip
  • os
  • os_version
  • kernel_version
  • model
  • device
  • mountpoint
  • type
  • disk
  • disk_type
  • interface
  • process_name
  • pid
  • user

Installation

  • Create a new 'metric' index on your indexer/s, e.g. metrics_linux

Example indexes.conf :-

[metrics_linux]
coldPath = $SPLUNK_DB/metrics_linux/colddb
homePath = $SPLUNK_DB/metrics_linux/db
thawedPath = $SPLUNK_DB/metrics_linux/thaweddb
datatype = metric
  • Install the add-on on your Linux servers and enable the inputs. Either use the built-in Setup Page, or copy the input stanzas from the default directory to the local directory (i.e. local/inputs.conf) and enable them as required:

    • Update: disabled = 0
    • Update: index = metrics_linux
    • Note: DO NOT UPDATE sourcetype = metrics_csv
  • If you enable process monitoring, configure the relevant processes to monitor for your environment. Copy the stanza from the default directory to the local directory (i.e. local/process_mon.conf) and configure them as required:

    • Update: whitelist = bash,zsh,sshd,python.*
    • Update: blacklist = splunkd
    • Note: the whitelist and blacklist should be comma separated without spaces
  • Configure the relevant dimensions for your environment. Copy the dimensions from the default directory to the local directory (i.e. local/dims.conf) and configure them as required:

    • Note: you can set cloud to aws or gcp and the built-in scripts will Auto-Discover the Region and Zone of the instance, e.g.

      [all]
      cloud = gcp
      
    • Shell environment variables are also supported, e.g.

      [all]
      environment = $Deploy_Environment
      
  • Install the "Splunk App for Infrastructure" on your Search Head

    • IMPORTANT: Update the 'sai_metrics_indexes' macro, e.g. index=metrics_linux

Troubleshooting

  • If you don't see any Entities under 'Investigate' in the Splunk App for Infrastructure :-

    • Update the 'sai_metrics_indexes' macro in the Splunk App for Infrastructure, e.g. index=metrics_linux
  • Error when enabling inputs via the Setup Page:

    Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/TA-linux-metrics/data/inputs/script/.%252Fbin%252Fcpu_usage.sh
    
    • Create a new 'metric' index before you enable any inputs
  • Run the following search to confirm that metrics are being indexed :-

    | mcatalog values(metric_name)
    
  • If you see similar errors to the following in 'splunkd.log' on the forwarder :-

    02-03-2020 16:26:45.553 +1100 WARN  IndexProcessor - The metric name is missing for source=/opt/splunk/etc/apps/TA-linux-metrics/bin/cpu_usage.sh, sourcetype=cpu_usage, host=foo, index=metrics_linux. Metric event data without a metric name is invalid and cannot be indexed. Ensure the input metric data is not malformed. raw=["_time","metric_name:cpu.user","metric_name:cpu.system","metric_name:cpu.nice","metric_name:cpu.idle","metric_name:cpu.wait","metric_name:cpu.interrupt","metric_name:cpu.softirq","metric_name:cpu.steal","model","cloud","region","dc","environment","ip","os","os_version","kernel_version"]
    
    02-03-2020 16:26:45.553 +1100 WARN  IndexProcessor - The metric value=<unset> is not valid for source=/opt/splunk/etc/apps/TA-linux-metrics/bin/cpu_usage.sh, sourcetype=cpu_usage, host=foo, index=metrics_linux. Metric event data with an invalid metric value cannot be indexed. Ensure the input metric data is not malformed. raw=["_time","metric_name:cpu.user","metric_name:cpu.system","metric_name:cpu.nice","metric_name:cpu.idle","metric_name:cpu.wait","metric_name:cpu.interrupt","metric_name:cpu.softirq","metric_name:cpu.steal","model","cloud","region","dc","environment","ip","os","os_version","kernel_version"]
    
    • Ensure that the sourcetype is set to metrics_csv and your forwarder is at least v8.0.x

Contact

  • Developers:
    • Luke Harris (Data Analytics Practice Lead at Katana1)
    • Chris Barbour (Professional Services Consultant at Katana1)
  • Web: https://katana1.com

Release Notes

Version 1.0.3
Jan. 30, 2020

* Fixed script to source Shell Environment Variables

Version 1.0.2
Jan. 28, 2020

* Bug Fixes

Version 1.0.1
Jan. 24, 2020

* Updated the Setup Page
* Updated image icons
* Updated default whitelist for Process Monitoring
* Added "noproxy" option to aws and gcp scripts
* Various bug fixes

Version 1.0.0
Jan. 21, 2020

Initial Release

24
Installs
144
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2020 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.