Splunk For Nagios hostperf and serviceperf Log Format

[ivedasolutions]

I am attempting to setup Splunk for Nagios and I am having quite a few problems. First off, even with MK Livestatus, check_mk and the check_mk-agent installed, the Livestatus dashboards do not work. All I get is N/A and then after a few moments the N/A's are replaced with <<<\check_mk>>>. When trying to troubleshoot and dissect some of the queries being used for checking up hosts and down hosts from the logs that are being sent to Splunk from Nagios, they return nothing. My guess is that the format of the hostperf and serviceperf log files are wrong however, I have not been able to find ANYWHERE that tells me what format these need to be in. All of the documentation I have found is seriously lacking in configuring Splunk for Nagios. Any additional help is most appreciated.

Thank you!

[lukeh]

Hi,

The definitions for the host and service performance logs are available at the Documentation link here:

http://apps.splunk.com/app/352/

Which version of the following apps are you running in your environment:

Splunk

Splunk for Nagios

Nagios

MK Livestatus

BTW, Splunk for Nagios 3.0.0 has been released and is much easier to configure for MK Livestatus, so please upgrade first 🙂

All the best,

Luke 🙂

[ivedasolutions]

Bump...

No one has any ideas what is going on here?