Getting Data In

Universal Forwarder on Raspberry Pi

phoenixdigital
Builder

Wondering what the chances are of getting a Universal Forwarder compilation for an ARM device such as Raspberry Pi?
http://en.wikipedia.org/wiki/Raspberry_Pi

These devices make great little remote machines which would be perfect for monitoring systems in the field.

I am aware I could just have software feed back to Splunk via a port but would love to utilise the Universal Forwarder if possible.

Tags (1)
1 Solution

Ed
Splunk Employee
Splunk Employee

briang67
Communicator

I realize that this is an older thread, but I've had success exporting data to splunk from a raspberry pi without a forwarder. I just send my data to local syslog on the pi and then use socat to forward to a splunk server that has a tcp input.

 cat /dev/ttyUSB0 | socat - TCP:192.168.1.23:8765

I don't have the ability to pre-process or queue the events, but the setup has been very reliable. My sensor sends about 12-15 events (event size 80 bytes) per second.

neiko
Explorer

Hi Guys, are we any closer to getting a forwarder for the Raspi?

0 Karma

phoenixdigital
Builder

I wouldn't really expect them to be giving me the source codes. However I would love a cross compiled version for Linux running on an ARM chip. Even a beta would be great I dont expect it to be fully supported.

I would think that it would be in Splunk's best interest to get Splunk onto the Raspberry Pi for a few reasons.

  1. Raspberry Pi is being promoted as an educational device. Teaching people about Splunk early could promote future sales as they enter the commercial arena.
  2. The low cost nature of this device means people can put more data collectors out in the fields. Which in turn means more data coming into Splunk. Which in turn means larger licence sales.
  3. Cheapest form of advertising you could get.

I could go on but I think I have made my case.

If someone at Splunk could please provide a Universal Forwarder for this device (even beta) I would be very appreciative. Our company is doing more and more work in SCADA environments and are hoping to leverage the use of many many Raspberry Pi devices combined with a Splunk Universal Forwarder to feed gigs of data into Splunk.

We are currently using the standard release of Debian on the Raspberry Pi
http://www.raspbian.org/

Cross compiling information can be found here
http://hertaville.com/2012/09/28/development-environment-raspberry-pi-cross-compiler/

Other OS options can be found here (if you dont like Raspbian)
http://www.raspberrypi.org/downloads

pshumate
Explorer

I would love to see a forwarder for the raspi. The internet of things starts here.

0 Karma

milestulett
Path Finder

Being given the code for universal forwarders so they could be end-user compiled would be the best solution. I'm after it so we can compile it for zLinux (s390 architecture), but have had no luck, even through enterprise support channels.

I'd raise a feature request and see how you get on.

Sorry 😕

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...