Use of collectd for machine metrics

[brent_weaver]

I just started to tinker with collectd to get metrics into splunk. Alothough easy to get data in, it seems to be VERY verbose. Is there a guide that I can refer to that will being me to a cleaner config? By cleaner I mean more direct information, like cumulitive CPU etc...

Also when writing to HEC I get [ ] around each JSON event making it a bit more manual to parse the events.

Any other thoughts, experiences, other ideas are welcome!

Thanks.

[MuS]

Hi brent_weaver,

try this https://www.splunk.com/pdfs/ebooks/a-beginners-guide-to-collectd.pdf maybe it contains some useful information.

cheers, MuS

[brent_weaver]

Thank you for the response and I have seen that. Do you know why there is a leading [ and a trailing ] on every event? It is supposed to be JSON output but it actually isn't valid. I have to:

index=main | rex "[(?P.*)]" | spath input=json

to get this to parse correctly. I am able to easily get logs into Splunk just need to know how to remove the ^[ and the ]$.