All Apps and Add-ons

How to differentiate between different redis hosts using Redis Add-on for Splunk?

Builder

I am trying to pull logs from three redis servers. I have them configured as separate inputs. However, I am unable to differentiate the logs using any metadata or field. I am sure I am missing something trivial. Would anyone shed some light on this?

0 Karma
1 Solution

Contributor

For any input, including modinputs you can add a host field to the inputs.conf like so. The inputs.conf is in the $Splunk_Home/apps/TA-splunk-addon-for-redis-server/local directory.

 [redis://www_cs01]
 authentication = password
 index = www
 interval = 60
 password = ********
 redis_host = wwwcs01
 redis_port = 6379
 host=wwwcs01

 [redis://www_cs02]
 authentication = password
 index = www
 interval = 60
 password = ********
 redis_host = wwwcs02
 redis_port = 6379
 host = wwwcs02

 [redis://www_cs03]
 authentication = password
 index = www
 interval = 60
 password = ********
 redis_host = wwwcs03
 redis_port = 6379
 host=wwwcs03

View solution in original post

Splunk Employee
Splunk Employee

I've updated the add-on to v1.0.3 to add the host.

0 Karma

Contributor

For any input, including modinputs you can add a host field to the inputs.conf like so. The inputs.conf is in the $Splunk_Home/apps/TA-splunk-addon-for-redis-server/local directory.

 [redis://www_cs01]
 authentication = password
 index = www
 interval = 60
 password = ********
 redis_host = wwwcs01
 redis_port = 6379
 host=wwwcs01

 [redis://www_cs02]
 authentication = password
 index = www
 interval = 60
 password = ********
 redis_host = wwwcs02
 redis_port = 6379
 host = wwwcs02

 [redis://www_cs03]
 authentication = password
 index = www
 interval = 60
 password = ********
 redis_host = wwwcs03
 redis_port = 6379
 host=wwwcs03

View solution in original post

Contributor

If they are coming from different servers, then the field you would use to differentiate is 'host'.

0 Karma

Builder

These are modular inputs configured on a data collector that has the add-on installed. The host field is populated by the hostname of the data collector instance.

0 Karma

Contributor

Ah, that makes sense. Can you post your inputs.conf from $Splunk_Home/apps/TA-splunk-addon-for-redis-server/local?

0 Karma

Builder
[redis://www_cs01]
authentication = password
index = www
interval = 60
password = ********
redis_host = wwwcs01
redis_port = 6379

[redis://www_cs02]
authentication = password
index = www
interval = 60
password = ********
redis_host = wwwcs02
redis_port = 6379

[redis://www_cs03]
authentication = password
index = www
interval = 60
password = ********
redis_host = wwwcs03
redis_port = 6379

Builder

Not sure if I can add a host= entry in these mod inputs.

0 Karma

Contributor

Give it a try and see if it works. I have the GitHub TA and it was built in the same way as this Redis. I have the host entry there and it works.

0 Karma

Builder

That worked! I knew it was going to be a trivial thing. I do wish the inputs automatically added either the redis_host field or made a host=field by itself. Thanks.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!