topic Re: StatsD backend for Splunk in Getting Data In

StatsD backend for Splunk

vistate — Mon, 23 Oct 2017 20:36:25 GMT

With the release of Splunk 7 and Metrics being top priority - I am trying to configure StatsD to send UDP traffic to my Splunk indexer. However, I am unable to configure statsD properly.

Has anyone created a Splunk backend for StatsD? I cannot find any documentation on this yet and I can only find info on setting up graphite as a backend.

Please help.

Re: StatsD backend for Splunk

gjanders — Mon, 23 Oct 2017 22:44:14 GMT

There is documentation here for getting in metrics from statsd

Re: StatsD backend for Splunk

vistate — Tue, 24 Oct 2017 13:49:31 GMT

Hi @garethatiag - thank you - reviewed the document. But it does not answer my question 🙂

StatsD requires a backend configuration. And the backends available from statsD are Graphite,
console and some others(https://github.com/etsy/statsd/blob/master/docs/backend.md)

So what I'm looking for is a backend configuration for splunk.

Re: StatsD backend for Splunk

vistate — Tue, 24 Oct 2017 16:20:55 GMT

I have managed to push to Splunk as a backend - however I am seeing this in the logs :

10-24-2017 12:17:01.099 -0400 ERROR MetricsProcessor - After splitting on delimiter (|), expected 2 tokens. Got 1 instead. Suppressing subsequent errors for source::tcp:8081, sourcetype::statsd, host::10.17.52.120 datastream...

Re: StatsD backend for Splunk

mporath_splunk — Mon, 30 Oct 2017 20:58:25 GMT

Splunk acts as both server and backend in this instance. In 7.0, you would send metrics directly to Splunk, without summarizing with a statsd server first.

Alternatively, you can configure a custom sourcetype to parse the graphite plaintext protocol. This would allow you to use the same configuration having the statsd server send summarized metrics to Splunk. This is described in as an example for custom source types in http://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/GetMetricsInOther#Example_of_configuring_field_extraction

Re: StatsD backend for Splunk

vistate — Tue, 31 Oct 2017 19:34:23 GMT

This is what is not described on the original page located here.

However,

It looks like my solution will be using both distributed Collectd+statsd Plugin as well as some direct ingestion.

Thank you very much for explaining.

Re: StatsD backend for Splunk

rjudet — Sun, 29 Mar 2020 03:44:07 GMT

Since 2017, it looks there should be an easier solution:

https://docs.splunk.com/Documentation/Splunk/7.2.0/Metrics/GetMetricsInStatsd

However, this is from Splunk Enterprise documentation, so my question would be: is this also available in Splunk Cloud, or, rather, how would we do it in Splunk Cloud?

Thanks

Re: StatsD backend for Splunk

rjudet — Sun, 29 Mar 2020 03:46:50 GMT

However, this is from Splunk Enterprise documentation, so my question would be: is this also available in Splunk Cloud, or, rather, how would we do it in Splunk Cloud?

Thanks