Possible to stream data into Splunk (like Graphite)?

[Myelin]

We're in the early stages of using Graphite to collect various metrics and people have begun using Grafana as the graphing/analytics tool on top of it. My question is why can't we use Splunk to do this?

The issue seems to be that Graphite allows you to just stream data to it instead of parsing logs. So my question is- Is it possible to stream data to Splunk instead of needing to feed it logs? And if so, how do I do that?

Thanks.

[buysse]

This is an old question, but the HTTP event collector is a good answer (and didn't exist at the time the last answers were added.) Rather than parsing a log, it's a HTTP POST to an endpoint. Docs are here: http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/UsetheHTTPEventCollector .

[halr9000]

I wrote a blog post on this topic: http://blogs.splunk.com/2013/07/26/getting-data-from-collectd-into-splunk/

[richgalloway]

You can feed any text into Splunk, not just logs. You can set up a Splunk TCP input to receive your data, but you'll still have to teach Splunk how to break it up into fields.

That said, this answer may better address your question.

[richgalloway]

Documentation for TCP input is at http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Monitornetworkports. I test mine using telnet.

[Myelin]

Is there page on how to setup streaming inputs? I tried doing this and could not get it to work- here were my steps:

Setup new TCP input in Splunk on port XXXX
On another Linux box ran this command:
echo "local.random.diceroll 4 date +%s" | nc ${INDEXER} ${PORT XXXX}
The above command was my attempt at sending a simple piece of data directly to Splunk, but I cannot find it anywhere in Splunk after sending it. Perhaps that command is wrong?