topic Re: Cannot fetch data into Splunk for Nagios in All Apps and Add-ons

Cannot fetch data into Splunk for Nagios

bmomartins — Thu, 06 Sep 2012 09:49:50 GMT

Hello everyone,

I have recently installed Splunk for Nagios and followed the configuration guidelines shown here:
http://splunk-base.splunk.com/apps/22374/splunk-for-nagios

If I go to Search app, I can see the Nagios log file and its events, but nothing shows on Splunk for Nagios dashboards.

What may be the cause? I will provide the configuration files contents as you ask me.

Best regards,

Bruno Martins

Re: Cannot fetch data into Splunk for Nagios

MarioM — Thu, 06 Sep 2012 10:16:19 GMT

all of the dashboards use searches based on index = nagios then you either modify all the searches or you get the data into an index which you created/named nagios.

And you need to make sure you have the right sourcetype assigned to the right data.

$NAGIOS_HOME/var/nagios.log sourcetype=nagios

$NAGIOS_HOME/var/host-perfdata sourcetype=nagioshostperf

$NAGIOS_HOME/var/service-perfdata sourcetype=nagiosserviceperf

Re: Cannot fetch data into Splunk for Nagios

bmomartins — Thu, 06 Sep 2012 11:02:19 GMT

Thanks for the fast response.

I have three sourcetypes:

serviceperf = /tmp/service-perfdata.log
hostperf = /tmp/host-perfdata.log
nagios = /var/log/nagios/nagios.log

In the Search app I see the files being indexed, but no information displayed in app Splunk for Nagios.

I have a index called nagios, but I can see that those files are being used by main index. How can I change this?

Re: Cannot fetch data into Splunk for Nagios

jgedeon120 — Fri, 07 Sep 2012 04:33:56 GMT

Just by looking at what you have there it doesn't look like you have the sourcetypes right. Also, do you have them going into the nagios index?

Sourcetypes should be:
nagios
nagiosserviceperf
nagioshostperf

Re: Cannot fetch data into Splunk for Nagios

MarioM — Fri, 07 Sep 2012 06:12:51 GMT

for the existing you cannot but new data you need to modify in your forwarders the inputs.conf by adding the following new line for each sourcetypes:

index=nagios

Re: Cannot fetch data into Splunk for Nagios

bmomartins — Fri, 07 Sep 2012 09:05:24 GMT

Ok, after some changes I have this working with one exception.

In the Livestatus Dashboard I should see service status the same way I can see that all hosts are up. Got to figure out why it is not getting information, because the log file from which it extracts this information is populated with events.

Re: Cannot fetch data into Splunk for Nagios

lukeh — Fri, 04 Oct 2013 07:32:45 GMT

Hi Bruno,

Please upgrade to the latest release and let me know how you go 🙂

All the best,

Luke 🙂