Dashboards & Visualizations

How to display Nagios down times in Splunk dashboard

nhamel
Explorer

We have alarming for our servers realized in Nagios.

When we deploy new software releases on the servers, we set a downtime in Nagios to avoid alarming during this time.

The Splunk dashboards (for example, count of events) are not aware of these downtimes. So the chart shows zero events for the deployment time without any explanation. So most likely the boss will ask what happened during this time...

Is there any idea how to make Splunk charts aware of Nagios downtimes?
Can we insert Splunk events from the Nagios server via CLI?

Thanks
Norbert

0 Karma

lukeh
Contributor

Hi Norbert 🙂

I developed an app for that 🙂 You can use Splunk For Nagios to search Nagios downtime events, alerts and notifications and trend problems over time. Over 40 field extractions are included, as well as 8 Saved Searches, and Advanced Dashboards featuring recent Warning and Critical Alerts, as well as Integration with MK Livestatus and the ability to Schedule Saved Searches in Splunk to send alerts to Nagios:

http://splunk-base.splunk.com/apps/22374/splunk-for-nagios

All the best,

Luke 🙂

0 Karma

nhamel
Explorer

Hi,

thanks for your input, but this is not what I was looking for.
When the servers are in downtime, I have no events in Splunk, so nothing to filter.

I need to get the information from Nagios, that the server is in scheduled downtime and not down by technical problems.

So I would like to send an event from nagios to Splunk, stating that the downtime is starting or stopping. These events could then be displayed in the chart ...

0 Karma

MuS
Legend

you can have your nagios events send to splunk
- as syslog event
- as snmptrap
- write it into a file
and then for sure you must setup splunk and your dashboard the way it can handle this nagios event.

0 Karma

MuS
Legend

hi nhamel

there is an app http://splunk-base.splunk.com/apps/29098/host-filter which could help you filter out host if they are on a planed downtime.

cheers

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...