All Apps and Add-ons

Splunk App for infrastructure help

brent_weaver
Builder

I am looking at implementing this input on my Linux hosts. I see there is an Add-on and an App. I would expect there to be inputs in the add-on app but there are not. Where is the collector for this? Should I just go back to nmon and call it a day? This is very poorly documented which surprises me from splunk as they are usually better than this.

0 Karma
1 Solution

bashby_splunk
Splunk Employee
Splunk Employee

Hey there!

For Linux hosts, the Splunk App for Infrastructure (SAI) collects metrics data with collectd and log data with a universal forwarder. For metrics collection, SAI uses a custom collectd plug-in called write_splunk that sends collectd data to Splunk via the HTTP Event Collector.

Install SAI only on search heads. Install the Splunk Add-on for Infrastructure only on indexers. Install collectd and/or a universal forwarder on Linux hosts to collect data from hosts.

For information about collecting data from Linux hosts, check out https://docs.splunk.com/Documentation/InfraApp/2.0.1/Admin/AddDataLinux.

View solution in original post

bashby_splunk
Splunk Employee
Splunk Employee

Hey there!

For Linux hosts, the Splunk App for Infrastructure (SAI) collects metrics data with collectd and log data with a universal forwarder. For metrics collection, SAI uses a custom collectd plug-in called write_splunk that sends collectd data to Splunk via the HTTP Event Collector.

Install SAI only on search heads. Install the Splunk Add-on for Infrastructure only on indexers. Install collectd and/or a universal forwarder on Linux hosts to collect data from hosts.

For information about collecting data from Linux hosts, check out https://docs.splunk.com/Documentation/InfraApp/2.0.1/Admin/AddDataLinux.

brent_weaver
Builder

Thank you for this info. So is collectd deployed through an app or do I need to install it with automation? I have used collectd usin write_http output plugin.

0 Karma

gjanders
SplunkTrust
SplunkTrust

The app (on the search head) will help generate a script that will assist in the collectd installation...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...