topic Collectd dosent send data to splunk in Getting Data In

Collectd dosent send data to splunk

aalaa — Tue, 04 Feb 2020 09:30:14 GMT

Hello Splunkers ,

I install collectd in the same server when i install splunk , i want to get the system data from this server
the collectd service is active but i can't see any data in splunk ,

this is the configuration under collectd.conf :

LoadPlugin write_http

URL "https://X.X.X.X:8088/services/collector/raw?channel=bfd29681-2722-48c7-8495-05f492dd2bce"
Header "Authorization: Splunk bfd29681-2722-48c7-8495-05f492dd2bce"
Format "JSON"
Metrics true
StoreRates true



server "X.X.X.X"
port "8088"
token "bfd29681-2722-48c7-8495-05f492dd2bce"
ssl false
verifyssl false

Any help please ?

Re: Collectd dosent send data to splunk

asabatini23 — Tue, 04 Feb 2020 14:51:07 GMT

have you used http event collector?

Re: Collectd dosent send data to splunk

mattymo — Tue, 04 Feb 2020 22:42:30 GMT

you can also check /etc/collectd.log or your os equivalent path to see what the issue is.

I recommend using the easy installer that comes with Splunk app for infrastructure!

https://docs.splunk.com/Documentation/InfraApp/2.0.1/Admin/AddDataLinux

Re: Collectd dosent send data to splunk

aalaa — Wed, 05 Feb 2020 08:44:12 GMT

Thank you @mmodestino_splunk it's very helpfull