Archive

Possible to stream data into Splunk (like Graphite)?

Explorer

We're in the early stages of using Graphite to collect various metrics and people have begun using Grafana as the graphing/analytics tool on top of it. My question is why can't we use Splunk to do this?

The issue seems to be that Graphite allows you to just stream data to it instead of parsing logs. So my question is- Is it possible to stream data to Splunk instead of needing to feed it logs? And if so, how do I do that?

Thanks.

Explorer

This is an old question, but the HTTP event collector is a good answer (and didn't exist at the time the last answers were added.) Rather than parsing a log, it's a HTTP POST to an endpoint. Docs are here: http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/UsetheHTTPEventCollector .

0 Karma

Motivator
0 Karma

SplunkTrust
SplunkTrust

You can feed any text into Splunk, not just logs. You can set up a Splunk TCP input to receive your data, but you'll still have to teach Splunk how to break it up into fields.

That said, this answer may better address your question.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

Documentation for TCP input is at http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Monitornetworkports. I test mine using telnet.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Is there page on how to setup streaming inputs? I tried doing this and could not get it to work- here were my steps:

Setup new TCP input in Splunk on port XXXX
On another Linux box ran this command:
echo "local.random.diceroll 4 date +%s" | nc ${INDEXER} ${PORT XXXX}
The above command was my attempt at sending a simple piece of data directly to Splunk, but I cannot find it anywhere in Splunk after sending it. Perhaps that command is wrong?

0 Karma