All Apps and Add-ons

Splunk App for infrastructure help

brent_weaver
Builder

I am looking at implementing this input on my Linux hosts. I see there is an Add-on and an App. I would expect there to be inputs in the add-on app but there are not. Where is the collector for this? Should I just go back to nmon and call it a day? This is very poorly documented which surprises me from splunk as they are usually better than this.

0 Karma
1 Solution

bashby_splunk
Splunk Employee
Splunk Employee

Hey there!

For Linux hosts, the Splunk App for Infrastructure (SAI) collects metrics data with collectd and log data with a universal forwarder. For metrics collection, SAI uses a custom collectd plug-in called write_splunk that sends collectd data to Splunk via the HTTP Event Collector.

Install SAI only on search heads. Install the Splunk Add-on for Infrastructure only on indexers. Install collectd and/or a universal forwarder on Linux hosts to collect data from hosts.

For information about collecting data from Linux hosts, check out https://docs.splunk.com/Documentation/InfraApp/2.0.1/Admin/AddDataLinux.

View solution in original post

bashby_splunk
Splunk Employee
Splunk Employee

Hey there!

For Linux hosts, the Splunk App for Infrastructure (SAI) collects metrics data with collectd and log data with a universal forwarder. For metrics collection, SAI uses a custom collectd plug-in called write_splunk that sends collectd data to Splunk via the HTTP Event Collector.

Install SAI only on search heads. Install the Splunk Add-on for Infrastructure only on indexers. Install collectd and/or a universal forwarder on Linux hosts to collect data from hosts.

For information about collecting data from Linux hosts, check out https://docs.splunk.com/Documentation/InfraApp/2.0.1/Admin/AddDataLinux.

brent_weaver
Builder

Thank you for this info. So is collectd deployed through an app or do I need to install it with automation? I have used collectd usin write_http output plugin.

0 Karma

gjanders
SplunkTrust
SplunkTrust

The app (on the search head) will help generate a script that will assist in the collectd installation...

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...