Splunk manage Arduino sensors output messages ?

[nicox77]

Is it possible for Splunk to manage "live" Arduinos sensors datas like :

Rain Data
1.00mm; 0s;
Temp reading = 23.73 degress C
Light reading = 442 - Light

And to provide all Splunk services, make reports, provide alerting, ..... ?

[Stevelim]

You can also make use of Kepware's UCON driver to create a custom interface. After which forward that data to the Splunk instance via the IDF in real time. In that way, there will be no need to store any data in your server since all of them are properly indexed inside Splunk itself. This also gives you the added benefit of displaying the data in real time on a dashboard.

Alternatively, you can also load up the Modbus library on your Arudino, assign the values to the correct registers and communicate with Kepware as the Modbus Master. That way, you can avoid developing the UCON driver and just grab the off the shelf Modbus drivers.

Link for Modbus library: https://code.google.com/p/simple-modbus/

[nicox77]

Thanks all for your answers
These sensors send these kind of messages always with "time", it's a live data flow, and we'll store all these infos in our server.

[tgow]

How is the data getting logged? Remember that Splunk can handle any source of data.

Can you provide a full log entry? Is time anywhere in the event?

Splunk stores all of the data on the back-end by time.

If this is a typical entry then you will probably have to setup some of the following options in the props.conf:

[yoursourcetype]
SHOULD_LINEMERGE = True
BREAK_ONLY_BEFORE = ^Rain

[Ayn]

Yes. If it's text, Splunk will happily index it. You will have to handle getting the data from the sensors and building the alerts etc, but it's definitely most possible.