Splunk Search

Splunk manage Arduino sensors output messages ?

nicox77
New Member

Is it possible for Splunk to manage "live" Arduinos sensors datas like :

Rain Data
1.00mm; 0s;
Temp reading = 23.73 degress C
Light reading = 442 - Light

And to provide all Splunk services, make reports, provide alerting, ..... ?

Tags (2)
0 Karma

Stevelim
Communicator

You can also make use of Kepware's UCON driver to create a custom interface. After which forward that data to the Splunk instance via the IDF in real time. In that way, there will be no need to store any data in your server since all of them are properly indexed inside Splunk itself. This also gives you the added benefit of displaying the data in real time on a dashboard.

Alternatively, you can also load up the Modbus library on your Arudino, assign the values to the correct registers and communicate with Kepware as the Modbus Master. That way, you can avoid developing the UCON driver and just grab the off the shelf Modbus drivers.

Link for Modbus library: https://code.google.com/p/simple-modbus/

0 Karma

nicox77
New Member

Thanks all for your answers
These sensors send these kind of messages always with "time", it's a live data flow, and we'll store all these infos in our server.

0 Karma

tgow
Splunk Employee
Splunk Employee

How is the data getting logged? Remember that Splunk can handle any source of data.

Can you provide a full log entry? Is time anywhere in the event?

Splunk stores all of the data on the back-end by time.

If this is a typical entry then you will probably have to setup some of the following options in the props.conf:

[yoursourcetype]
SHOULD_LINEMERGE = True
BREAK_ONLY_BEFORE = ^Rain
0 Karma

Ayn
Legend

Yes. If it's text, Splunk will happily index it. You will have to handle getting the data from the sensors and building the alerts etc, but it's definitely most possible.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...