topic Re: Splunk App for infrastructure help in All Apps and Add-ons

Splunk App for infrastructure help

brent_weaver — Wed, 11 Dec 2019 13:57:34 GMT

I am looking at implementing this input on my Linux hosts. I see there is an Add-on and an App. I would expect there to be inputs in the add-on app but there are not. Where is the collector for this? Should I just go back to nmon and call it a day? This is very poorly documented which surprises me from splunk as they are usually better than this.

Re: Splunk App for infrastructure help

bashby_splunk — Thu, 12 Dec 2019 19:45:46 GMT

Hey there!

For Linux hosts, the Splunk App for Infrastructure (SAI) collects metrics data with collectd and log data with a universal forwarder. For metrics collection, SAI uses a custom collectd plug-in called write_splunk that sends collectd data to Splunk via the HTTP Event Collector.

Install SAI only on search heads. Install the Splunk Add-on for Infrastructure only on indexers. Install collectd and/or a universal forwarder on Linux hosts to collect data from hosts.

For information about collecting data from Linux hosts, check out https://docs.splunk.com/Documentation/InfraApp/2.0.1/Admin/AddDataLinux.

Re: Splunk App for infrastructure help

brent_weaver — Mon, 16 Dec 2019 02:09:05 GMT

Thank you for this info. So is collectd deployed through an app or do I need to install it with automation? I have used collectd usin write_http output plugin.

Re: Splunk App for infrastructure help

gjanders — Mon, 16 Dec 2019 10:55:37 GMT

The app (on the search head) will help generate a script that will assist in the collectd installation...