We have alarming for our servers realized in Nagios.
When we deploy new software releases on the servers, we set a downtime in Nagios to avoid alarming during this time.
The Splunk dashboards (for example, count of events) are not aware of these downtimes. So the chart shows zero events for the deployment time without any explanation. So most likely the boss will ask what happened during this time...
Is there any idea how to make Splunk charts aware of Nagios downtimes?
Can we insert Splunk events from the Nagios server via CLI?
I developed an app for that 🙂 You can use Splunk For Nagios to search Nagios downtime events, alerts and notifications and trend problems over time. Over 40 field extractions are included, as well as 8 Saved Searches, and Advanced Dashboards featuring recent Warning and Critical Alerts, as well as Integration with MK Livestatus and the ability to Schedule Saved Searches in Splunk to send alerts to Nagios:
you can have your nagios events send to splunk
- as syslog event
- as snmptrap
- write it into a file
and then for sure you must setup splunk and your dashboard the way it can handle this nagios event.