All Apps and Add-ons

Possible to stream data into Splunk (like Graphite)?

Myelin
Explorer

We're in the early stages of using Graphite to collect various metrics and people have begun using Grafana as the graphing/analytics tool on top of it. My question is why can't we use Splunk to do this?

The issue seems to be that Graphite allows you to just stream data to it instead of parsing logs. So my question is- Is it possible to stream data to Splunk instead of needing to feed it logs? And if so, how do I do that?

Thanks.

buysse
Explorer

This is an old question, but the HTTP event collector is a good answer (and didn't exist at the time the last answers were added.) Rather than parsing a log, it's a HTTP POST to an endpoint. Docs are here: http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/UsetheHTTPEventCollector .

0 Karma

halr9000
Motivator
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can feed any text into Splunk, not just logs. You can set up a Splunk TCP input to receive your data, but you'll still have to teach Splunk how to break it up into fields.

That said, this answer may better address your question.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Documentation for TCP input is at http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Monitornetworkports. I test mine using telnet.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Myelin
Explorer

Is there page on how to setup streaming inputs? I tried doing this and could not get it to work- here were my steps:

Setup new TCP input in Splunk on port XXXX
On another Linux box ran this command:
echo "local.random.diceroll 4 date +%s" | nc ${INDEXER} ${PORT XXXX}
The above command was my attempt at sending a simple piece of data directly to Splunk, but I cannot find it anywhere in Splunk after sending it. Perhaps that command is wrong?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...