topic Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers? in All Apps and Add-ons

In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

omprakash9998 — Wed, 12 Dec 2018 15:23:05 GMT

Hi,

We have a Splunk environment with universal forwarders already installed on our Windows servers. We want to try the Splunk App for infrastructure. Can we use the existing Universal Forwarders to use the Splunk App for Infrastructure without having to running the script and reinstalling on all of our servers.

Thanks.

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

dagarwal_splunk — Wed, 12 Dec 2018 18:14:17 GMT

You need to setup inputs.conf (add all metrics and logs data to collect) and outputs.conf (send data to SAI instance) on existing Splunk Universal Forwarders.

Here is useful link:
http://docs.splunk.com/Documentation/InfraApp/1.2.2/Admin/ManualInstallWindowsUF

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

omprakash9998 — Fri, 14 Dec 2018 16:27:00 GMT

Can we install the Splunk App for Infrastructure on the same search head we have been using to search our data. If yes, so all that we have to change is the index to which the data is routing.?

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

dagarwal_splunk — Fri, 14 Dec 2018 18:22:05 GMT

yes, SAI will be installed in the search head.

Index is set as "em_metrics" in UF's inputs.conf for "perfmon:*" metrics data as mentioned in the above links.
Just make sure you have Add-on for infra installed in your indexers. https://splunkbase.splunk.com/app/4217/
See the docs for more info http://docs.splunk.com/Documentation/InfraApp/1.2.2/Install/DistributedDeployment

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Mon, 17 Dec 2018 19:08:15 GMT

I have similar environment, If I go to Investigate > Entiries, I can see the Entity Name, if I click Entity Name, I can see overview with number of events, but no results found for CPU, Disk Memory and Network. Please help.

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

dagarwal_splunk — Mon, 17 Dec 2018 20:33:38 GMT

What version of SAI(Splunk App for Infra) are you using?
Do you have Splunk Add-on for Windows installed on the same instance as SAI? If yes, that may be the problem.

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Mon, 17 Dec 2018 20:41:57 GMT

SAI version: 1.2.1, I also have Splunk Add-on for Infrastructure 1.2.1 installed, but no Splunk Add-on for Windows installed.

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

dagarwal_splunk — Mon, 17 Dec 2018 21:09:15 GMT

It seems that you don't have "inputs.conf" configured in the Universal Forwarder of Windows machine you are monitoring. You need to add all the performance counters you want to collect. Can you check?
See this for sample inputs.conf: https://answers.splunk.com/answers/699711/can-you-help-me-use-the-splunk-app-for-infrastruct.html#answer-699721

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

dagarwal_splunk — Tue, 29 Sep 2020 22:25:15 GMT

@qhmassc Try adding "entity_type::Windows_Host" to your _meta fields in "inputs.conf"

It should look like:

[perfmon://CPU Load]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 30
object = Processor
index = em_metrics
_meta = os::"Microsoft Windows" entity_type::Windows_Host

Similarly add other perfmon data you want to add using the sample inputs.conf file.

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

omprakash9998 — Tue, 18 Dec 2018 16:29:21 GMT

It Worked.

Thank you

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Tue, 18 Dec 2018 17:27:59 GMT

it works now, Thanks

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Wed, 02 Jan 2019 15:40:54 GMT

Thanks.
How can configure Linux box to do the same thing for the performance monitoring? which configure file I need to change? and how to change?

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Fri, 04 Jan 2019 16:49:44 GMT

I have Splunk App for Infrastructure installed and configured, it works for Windows agent---Thanks for your help, but I cannot make it for Linux servers.
I run the install script, I can start both collectd and splunk agent services, collectd.log file is located under /etc/collectd/. But I cannot see Linux servers under Entities with Splunk App for Infrastructure. I can see other log files if I use searching and reporting app.

Please help.

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

dagarwal_splunk — Fri, 04 Jan 2019 17:43:19 GMT

Are there any errors in /etc/collectd/collectd.log file ?

Something like "curl failed" ?

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Fri, 04 Jan 2019 17:53:31 GMT

here is Customization for Splunk:

       server "100.111.111.111"
       port "8088"
       token "xxxxxxxxxxxxxxxxxxxxxxxxxx"
       ssl true
       verifyssl false

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Fri, 04 Jan 2019 17:55:32 GMT

[2019-01-04 10:43:01] [info] Initialization complete, entering read-loop.
[2019-01-04 11:28:17] [info] Exiting normally.
[2019-01-04 11:28:17] [info] collectd: Stopping 5 read threads.
[2019-01-04 11:28:17] [info] collectd: Stopping 5 write threads.
[2019-01-04 11:28:17] [info] Initialization complete, entering read-loop.
[2019-01-04 11:57:51] [info] Exiting normally.
[2019-01-04 11:57:51] [info] collectd: Stopping 5 read threads.
[2019-01-04 11:57:51] [info] collectd: Stopping 5 write threads.
[2019-01-04 11:57:51] [info] Initialization complete, entering read-loop.
[2019-01-04 12:25:35] [info] Exiting normally.
[2019-01-04 12:25:35] [info] collectd: Stopping 5 read threads.
[2019-01-04 12:25:35] [info] collectd: Stopping 5 write threads.
[2019-01-04 12:25:35] [info] Initialization complete, entering read-loop.
[2019-01-04 12:29:45] [info] Exiting normally.
[2019-01-04 12:29:45] [info] collectd: Stopping 5 read threads.
[2019-01-04 12:29:45] [info] collectd: Stopping 5 write threads.
[2019-01-04 12:30:49] [info] Initialization complete, entering read-loop.

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

dagarwal_splunk — Fri, 04 Jan 2019 17:55:55 GMT

What about the log file for collectd ? Also, What OS version you are using?

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Fri, 04 Jan 2019 17:58:17 GMT

[2019-01-04 12:29:45] [info] Exiting normally.
[2019-01-04 12:29:45] [info] collectd: Stopping 5 read threads.
[2019-01-04 12:29:45] [info] collectd: Stopping 5 write threads.
[2019-01-04 12:30:49] [info] Initialization complete, entering read-loo

Linux 6.7

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Fri, 04 Jan 2019 17:59:36 GMT

No error:
Exiting normally.
collectd: Stopping 5 read threads.
collectd: Stopping 5 write threads.
Initialization complete, entering read-loop.

Linux 6.7

Re: In the Splunk App for Infrastructure, can you use existing universal forwarders without running the script and reinstalling on all of our servers?

qhmassc — Fri, 04 Jan 2019 18:02:22 GMT

Linux version: 2.6.32-642.15.1.el6.x86_64