Splunk App for infrastructure help

[brent_weaver]

I am looking at implementing this input on my Linux hosts. I see there is an Add-on and an App. I would expect there to be inputs in the add-on app but there are not. Where is the collector for this? Should I just go back to nmon and call it a day? This is very poorly documented which surprises me from splunk as they are usually better than this.

[bashby_splunk · Accepted solution]

Hey there!

For Linux hosts, the Splunk App for Infrastructure (SAI) collects metrics data with collectd and log data with a universal forwarder. For metrics collection, SAI uses a custom collectd plug-in called write_splunk that sends collectd data to Splunk via the HTTP Event Collector.

Install SAI only on search heads. Install the Splunk Add-on for Infrastructure only on indexers. Install collectd and/or a universal forwarder on Linux hosts to collect data from hosts.

For information about collecting data from Linux hosts, check out https://docs.splunk.com/Documentation/InfraApp/2.0.1/Admin/AddDataLinux.

[brent_weaver]

Thank you for this info. So is collectd deployed through an app or do I need to install it with automation? I have used collectd usin write_http output plugin.

[gjanders]

The app (on the search head) will help generate a script that will assist in the collectd installation...