Getting Data In

SNMP metrics with collectd

mmoermans
Path Finder

Following the documentation here https://docs.splunk.com/Documentation/Splunk/7.2.0/Metrics/GetMetricsInCollectd we're trying to get SNMP data with collectd into a metrics index.

The current format we're receiving is as follows (about 50% of the entire event using sourcetype snmp_ta):

["value"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"cpu","plugin_instance":"2","type":"cpu","type_instance":"softirq"},{"values":[0],"dstypes":["derive"],"dsnames":["value"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"cpu","plugin_instance":"2","type":"cpu","type_instance":"idle"},{"values":[98.1006747093728],"dstypes":["derive"],"dsnames":["value"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"cpu","plugin_instance":"3","type":"cpu","type_instance":"idle"},{"values":[16.1998630209115,3.59996956020255],"dstypes":["derive","derive"],"dsnames":["rx","tx"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"interface","plugin_instance":"ens192","type":"if_packets","type_instance":""},{"values":[2098.28607958568,6531.45666911971],"dstypes":["derive","derive"],"dsnames":["rx","tx"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"interface","plugin_instance":"ens192","type":"if_octets","type_instance":""},{"values":[0,0],"dstypes":["derive","derive"],"dsnames":["rx","tx"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"interface","plugin_instance":"ens192","type":"if_errors","type_instance":""},{"values":[0,0],"dstypes":["derive","derive"],"dsnames":["rx","tx"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"interface","plugin_instance":"ens192","type":"if_dropped","type_instance":""},{"values":[16.0999211648893,16.0999211648893],"dstypes":["derive","derive"],"dsnames":

How do you get the right format for metrics?
The events don't show up in the metrics index but no error shows up either in the _internal log.

1 Solution

mmoermans
Path Finder

Got it working by using a different collection URL and changing the sourcetype to collectd_http.

View solution in original post

mmoermans
Path Finder

Got it working by using a different collection URL and changing the sourcetype to collectd_http.

Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...