topic Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration in All Apps and Add-ons

Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

syncsyn — Thu, 04 May 2017 13:18:16 GMT

Preface: I've already looked through the other answers and any examples I found/tried didn't fix the problem.

Problem: Getting log events pushed to Splunk from Jenkins, but the dashboard app shows nothing. I'm thinking it's the meta-data configuration that's wrong. Does anyone have a good working example of what the meta-data configuration should look like on the Jenkins side? We're using pipelines, if that makes a difference. If anyone has suggestions that aren't around the meta-data configuration please feel free to let me know.

Thanks!
Syncs

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

adonio — Fri, 05 May 2017 01:25:19 GMT

if you see events but not data in dashboard, the first thing i will check is if the indexes that are shipped with the app are searched by default by the user who looks at the dashboard
navigate to settings -> access control -> roles -> the role your user has -> scroll down all the way -> add the 4 jenkins indexes to indexes searched by default.

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

txiao_splunk — Fri, 05 May 2017 12:53:07 GMT

Checkout https://wiki.jenkins-ci.org/display/JENKINS/Splunk+plugin+for+Jenkins
For Splunk version 6.5 or later, it is recommended to use the plugin's default config
For Splunk 6.3.x or 6.4.x, please adjust the default sourcetype to json:jenkins:old (please remove it if Splunk get upgraded to latest version otherwise data will be extracted twice)
Can you get any results for below two searches?

index=jenkins_statistics event_tag=job_event
index=jenkins_statistics job_event

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

syncsyn — Fri, 05 May 2017 16:24:05 GMT

Thanks @adonio I'll have to get my Splunk admins to check it out, they only give our corp users admin rights. So i can't see "Access Control". I'll get back to you as soon as I can!

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

syncsyn — Fri, 05 May 2017 16:39:00 GMT

@Txiao

The first search query returns no results. The second query returns lots of results where the source = "jenkins/job_event", and the sourcetype = "json:jenkins"

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

txiao_splunk — Fri, 05 May 2017 16:52:14 GMT

what is the version of splunk which is used http event collector? 6.3 or 6.4?

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

syncsyn — Fri, 05 May 2017 16:58:58 GMT

We're on 6.5.0

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

adonio — Fri, 05 May 2017 17:57:29 GMT

in the meantime,
you can open a panel in search by clicking the magnifying glass icon on panels buttom
at the begging of the search string, place index=* and run the search, if it works, then great. if not, will check next that the app is set to global so all knowledge objects are global
cheers

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

syncsyn — Fri, 05 May 2017 18:27:17 GMT

That did not work. How do I check to see if the app is set to global? Is that another Splunk admin function?

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

adonio — Fri, 05 May 2017 18:33:50 GMT

when you search index = jenkins* | stats count by sourcetype
do you see any results?
do you see the fields eventtype and tag?

Re: Splunk App for Jenkins: What is the Recommended Meta-Data Configuration

syncsyn — Mon, 08 May 2017 13:58:37 GMT

Yes, i get lots of results. I do not have fields eventtype and tag.