Getting Data In

Use of collectd for machine metrics

brent_weaver
Builder

I just started to tinker with collectd to get metrics into splunk. Alothough easy to get data in, it seems to be VERY verbose. Is there a guide that I can refer to that will being me to a cleaner config? By cleaner I mean more direct information, like cumulitive CPU etc...

Also when writing to HEC I get [ ] around each JSON event making it a bit more manual to parse the events.

Any other thoughts, experiences, other ideas are welcome!

Thanks.

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi brent_weaver,

try this https://www.splunk.com/pdfs/ebooks/a-beginners-guide-to-collectd.pdf maybe it contains some useful information.

cheers, MuS

0 Karma

brent_weaver
Builder

Thank you for the response and I have seen that. Do you know why there is a leading [ and a trailing ] on every event? It is supposed to be JSON output but it actually isn't valid. I have to:

index=main | rex "[(?P.*)]" | spath input=json

to get this to parse correctly. I am able to easily get logs into Splunk just need to know how to remove the ^[ and the ]$.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...