I have installed "App for Cassandra Cluster Monitoring" and configured a Splunk Dashboard. I have also downloaded "Add-on for Cassandra Cluster", extracted on one node, changed paths within inputs.conf file within Splunk_TA_cassandra folder, updated disabled parameter to 1 for all metric collections, and restarted Splunk Forwarder on the local node.
However, I am still unable to see data data on the dashboard. Would you please share me, if I am missing any other steps?
Disabled = 1 is TRUE, meaning this input is disabled. This should be disabled = 0, which says that the input is not-disabled (it is enabled.)
Change that and let us know the results.
Thanks for update.
I have reverted back the Disabled settings per suggestions, am able to run all perl scripts on linux shell successfully, However, still not able to view metric data on "Splunk App for Cassandra".
Also have received following messages as well.
"Search peer xxxx.prod.com has the following message: Received event for unconfigured/disabled/deleted index=cassandara_process with source="source::source_stats_process" host="host::xxxxx" sourcetype="sourcetype::cassandra_PROCESS". So far received events from 6 missing index(es)"
Previously we had following configuration:
1 index per cluster.
1 source "system.log"
1 sourcetype systemlog
Now after configuring "add-on for cassandra", i can see search data for the other source types (cassandra_PROCESS, cassandra_MEM, etc.), plus, if i search from "Search and Reporting App", i can fetch data from other source types, but "App for Cassandra" is unable to show data/graphs and i can see "No Results Found".
I found out both the app and add-on are in a bad way. If you look carefully the message says "index=cassandara_process" (NOTE mispelled).
Current issues/problems in app (for indexers and search heads):
- The app is also missing the definition of the cassandra_nodestatus in default/indexes.conf.
- The Cluster Overview > cluster status panel has a bad embedded search
Issues in add-on (for forwarders):
- bin/*.pl scripts have a hardcoded path to nodetool
- Mispelled index in default/inputs.conf
- bin/netstats.pl doesn't parse "nodetool netstats" output correctly
I'm currently in the process of fixing these before I leave for vacation. If you want I'll try and upload these fixes if I can get the Splunk gatekeepers to approve.