All Apps and Add-ons

Splunk For Nagios hostperf and serviceperf Log Format

New Member

I am attempting to setup Splunk for Nagios and I am having quite a few problems. First off, even with MK Livestatus, check_mk and the check_mk-agent installed, the Livestatus dashboards do not work. All I get is N/A and then after a few moments the N/A's are replaced with <<<\check_mk>>>. When trying to troubleshoot and dissect some of the queries being used for checking up hosts and down hosts from the logs that are being sent to Splunk from Nagios, they return nothing. My guess is that the format of the hostperf and serviceperf log files are wrong however, I have not been able to find ANYWHERE that tells me what format these need to be in. All of the documentation I have found is seriously lacking in configuring Splunk for Nagios. Any additional help is most appreciated.

Thank you!

0 Karma



The definitions for the host and service performance logs are available at the Documentation link here:

Which version of the following apps are you running in your environment:


Splunk for Nagios


MK Livestatus

BTW, Splunk for Nagios 3.0.0 has been released and is much easier to configure for MK Livestatus, so please upgrade first 🙂

All the best,

Luke 🙂

0 Karma

New Member


No one has any ideas what is going on here?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!