Getting Data In

Using Splunk Universal Forwarder and scripted input to scrape JSON and write to a metrics index

thehowler
New Member

I've got a HTTP API that produces a JSON payload of metrics. The payload is formatted in a way that also works for POSTing (via cURL) to a Splunk HEC and ultimately getting inserted into a "metrics"-style index. An example of the payload:

 

 

 

 

{
    "event": "metric",
    "time": 1618573805075,
    "host": "myhostname",
    "fields": {
        "metric_name:ok.count": 1,
        "metric_name:error.count": 2
        "product_version": "1.2.3",
        "now_unix": 1618573805075052,
        "product_name": "my cool app"
    }
}

 

 

 

 

 This works well and I can query the data using

 

 

 

 

| mpreview index="my_index_name"

 

 

 

 

I'm trying to setup Splunk Universal Forwarder and using Scripted Input to cURL this endpoint and send it to the Splunk Indexer over port 9997 as per normal. I can see that the metrics endpoint is being "hit" by SUF, but I can't see any data in Splunk.

I have my Splunk-side props.conf as :

 

 

 

 

[my_json_metrics_via_suf]
INDEXED_EXTRACTIONS = json
KV_MODE = none

 

 

 

 

My SUF inputs.conf:

 

 

 

 

[script:///opt/splunkforwarder/etc/system/bin/my_curl_script.sh]
interval = 5
index = my_index_name
sourcetype = my_json_metrics_via_suf
disabled = false

 

 

 

 

 

Does anyone know what config I'm missing? I can see the data arriving at the Splunk server via `tcpdump`

Labels (3)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!