Kepware IDF for Splunk

[vkale]

Hi,
I am using IDF for Splunk to retrieve kepware tags data for reporting where splunk shows me realtime as well as history data of kepware tags. can anyone please tell me where the Kepware history data is stored exactly which splunk shows. is it in Kepware only or in Splunk?. If you provide me backup data file path and name it will be highly appreciable.

Thank you.

[kepSam]

Hello! When using KEPServerEX's IDF, the history you see in Splunk is stored only in your Splunk Indexer. Unless you are using our Local Historian or our DataLogger Plugin, KEPServerEX keeps only them most recent value for any data point in its internal cache.

If you're interested in storing data longer-term with KEPServerEX, have a look at our Local Historian and our DataLogger Plugin. NOTE that an OPC HDA Client is required to obtain data from the Local Historian Plugin:

http://www.kepware.com/spec-sheets/local-historian.asp

http://www.kepware.com/Products/OPC_Data_Logger.asp

Hope this helps!

Sam Elsner
Senior Applications Engineer
Kepware Technologies

[vkale]

Thank you for your reply
Even I tested some scenario's where it has been observed that the Splunk stores the data. But in one of the scenario I found some different observation. I stopped the splunkd service and disabled TCP port for connectivity with kepware. while disconnected with splunk entered some values manually in Kepware tags using OPC client. these values obviously not displayed in Splunk due to no connectivity. After I started splunkd service, enabled TCP port and then checked out for the data. this time only one value out of many values got displayed in splunk. please note the single value which splunk shows is not the current value in kepware OPC client at the time of connection with splunk. this value is sometimes the first value entered after disconnecting the splunk, which is already has been changed before splunk connection. this is confusing and not giving the exact idea about the storage.
please direct.

Regards,
Vijay Kale
Software Engineer
Sarla Technologies

[raylabbe]

Hi Vijay, I noticed you opened a case with us and I provided a detailed response through that. Thank you for the questions and feel free to contact Kepware directly if you have nay questions about our products.

There are potential cases where a couple of data change events end up within the buffer if the connection is lost. These events would be sent to Splunk on reconnection but this would not be considered a "store and forward" functionality as this buffer would not have many events. The IDF for Splunk plugin is only a data change event forwarder and is not designed to buffer events on connection loss. You can create a solution using Splunk's Universal Forwarder to provide local buffering if necessary.

[vkale]

Thanks for your reply Ray. It helped me in clearing the concepts and confusions.

[jbacharach]

Hello,

Good to hear that you are using Kepware to get data into Splunk. Out of curiosity, what type of data or from what devices?

I am part of the Kepware training team. The data streams from KEPServerEX real-time into Splunk, and the history of the data is done on the Splunk side. Thus the answer would be "only in Splunk". Check out our YouTube video for more details: https://youtu.be/6F-tIwZ3EKo.

If you have any further questions on this or need more information, feel free to contact training@kepware.com.