About dagarwal_splunk

dagarwal_splunk · ‎07-23-2019

The check for collectd version is placed in the install_agent script. Collectd 5.9 was just released and we haven't yet tested plugin with it. It should mostly work fine though. And , we plan to add support in the next release. In the meanwhile, you can try : manual install https://docs.splunk.com/Documentation/InfraApp/1.4.0/Admin/ManageAgents

dagarwal_splunk · ‎06-04-2019

I think this might work: 1. In SH and Indexers you will have collectd running (pointing to "localhost"). 2. SH collectd data forwarded to Indexer using inputs.conf (udp input) and outputs.conf (https://answers.splunk.com/answers/4209/search-head-configured-as-a-forwarder.html) OR install a new UF ? 3. Indexer you add inputs.conf (udp input). You should already have the SAI Add-on here.

dagarwal_splunk · ‎05-22-2019

I think you already have what you need for write_splunk https://docs.splunk.com/Documentation/InfraApp/1.3.0/Admin/ManageAgents . It is not Open Source yet. This document might help you: https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Configureindex-timefieldextraction .

dagarwal_splunk · ‎05-22-2019

Did you try the other props/transforms above?

dagarwal_splunk · ‎05-21-2019

You can try something like this to extract dimensions: props.conf add: [em_metrics] TRANSFORMS-mname=mname Transforms.conf add: [mname] SOURCE_KEY = field:metric_name REGEX = apache_hadoop\.\[id:([^,]+),user:([^,]+),queue:([^,]+),state:([^\]]+)\]\.\S+ FORMAT = id::$1 user::$2 queue::$3 state::$4 WRITE_META = true Make adjustments as you need..

dagarwal_splunk · ‎05-16-2019

You can try "Processes" plugin in collectd and see if you can get what you need. You can look into collectd documentation to learn how to configure it. you will have to add it to your collectd.conf and restart. This is for Linux host. For Windows host, you should already have perfmon "Process" data coming in. In the "Analysis" UI page, you should be able to split by "instance" (option on the right). This will provide you per process metrics.

dagarwal_splunk · ‎05-10-2019

I don't see any other easy way to get this metrics from perfmon.. Your approach looks fine to me to get the %Memory Usage..

dagarwal_splunk · ‎04-19-2019

Ubuntu bionic has collectd package. For some reason yours don't have that: https://packages.ubuntu.com/bionic/collectd Do apt-get update and retry?

dagarwal_splunk · ‎04-19-2019

Can you please try this command manually: apt-get install collectd . OR apt-cache policy collectd

dagarwal_splunk · ‎03-25-2019

yes. Here is the doc link: https://docs.splunk.com/Documentation/InfraApp/1.2.3/Admin/CustomIndexes

dagarwal_splunk · ‎03-21-2019

I have seen the same issue before. The issue was with the hec_token not being set properly with correct sourcetype OR Add on for Infra not installed. Are you sending collectd data directly to SAI or using any forwarder in between? For write_http to work for you, it needs collectd_http as the sourcetype. Did you change that after switching to write_http?

dagarwal_splunk · ‎03-20-2019

Sourcetype should be em_metrics not Automatic.

dagarwal_splunk · ‎03-20-2019

ALso, rerun the script with right hec_token if you have deleted and created a new token

dagarwal_splunk · ‎03-20-2019

Did you restart Splunk after installing "Splunk Add on for Infra" ?

dagarwal_splunk · ‎03-20-2019

Did you run the script on your terminal from "Add Data" page on Splunk App for Infra ?

dagarwal_splunk · ‎03-20-2019

Could you please check the hec token that you created? Make sure sourcetype and index is "em_metrics" for the token. https://docs.splunk.com/Documentation/InfraApp/1.2.3/Install/Install

dagarwal_splunk · ‎03-20-2019

Great !!!!

dagarwal_splunk · ‎03-20-2019

Can you check splunk log files here for errors: $SPLUNK_HOME/var/log/splunk/em_entity_manager.log (check other log files as well if you see any errors) ALso try to see if the missing host is present in the kv store: | inputlookup em_entities To run this search, go to splunk_web:8000/app/splunk_app_infrastructure/search {i.e run search in context of SAI}

dagarwal_splunk · ‎03-19-2019

First try this search: | mcatalog values("entity_type") as "entity_type" values("os") as "os" WHERE metric_name=processor.* AND index=em_metrics BY "host" Do you see your missing server/entity ? If no, try this: | mstats avg(_value) WHERE index=em_metrics AND metric_name=* AND host="missing_server_name" by metric_name Replace missing_server_name in this search.

dagarwal_splunk · ‎03-11-2019

So, the script didn't install the forwarder before it complained about the path? Check if "C:\Program Files\SplunkUniversalForwarder" exists. If it does, create the local directory it complained about and try to rerun the script. You can also setup data collection manually using this doc: https://docs.splunk.com/Documentation/InfraApp/1.2.3/Admin/ManualInstallWindowsUF

dagarwal_splunk · ‎03-07-2019

Could you check if you have this directory on your Windows system? "C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\"

dagarwal_splunk · ‎02-21-2019

You have to check inputs.conf in UF's "\etc\apps\SplunkUniversalForwarder\local\inputs.conf". This file will have perfmon stanzas. I think you should file "Splunk Support ticket" for quicker resolution. Or try the troubleshooting doc mentioned above.

dagarwal_splunk · ‎02-14-2019

Did you try this troubleshooting doc? https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata#Are_you_using_forwarders.3F

dagarwal_splunk · ‎02-14-2019

Check perfmon stanza's in your UF's inputs.conf file. Can you provide one of the input stanza here?

dagarwal_splunk · ‎02-13-2019

Can you try some commands on your SII instance using CLI? ${SPLUNK_HOME}/bin/splunk search '| mstats avg(_value) WHERE index=em_metrics AND metric_name=* by host, metric_name' ${SPLUNK_HOME}/bin/splunk search '| mstats avg(_value) WHERE index=em_metrics AND metric_name=* AND entity_type="Windows_Host" by host, metric_name'

Posts	126
Solutions	9
Karma Given	1
Karma Received	28
Member Since	‎07-30-2018

Online Status	Offline
Date Last Visited	‎02-09-2021 01:52 PM

Re: Splunk Insights for Infrastructure Unsupported...

Re: Splunk App For Infrastructure: How to get metr...

Re: How to extract custom dimension from metrics i...

Re: How to extract custom dimension from metrics i...

Re: How to extract custom dimension from metrics i...

Re: Metrics per process on Windows and Linux host

Re: perfmon Accurate Memory Utilization Percentage

Re: Unsupported debian version while installing co...

Re: Unsupported debian version while installing co...

Re: Can I use Splunk app for Infrastructure on met...

Re: Splunk App for Infrastructure, CentOS 7, JSON ...

Re: Splunk App for Infrastructure, CentOS 7, JSON ...

Re: Splunk App for Infrastructure, CentOS 7, JSON ...

Re: Splunk App for Infrastructure, CentOS 7, JSON ...

Re: Splunk App for Infrastructure, CentOS 7, JSON ...

Re: Splunk App for Infrastructure, CentOS 7, JSON ...

Re: Splunk App for Infrastructure (SAI) missing en...

Re: Splunk App for Infrastructure (SAI) missing en...

Re: Splunk App for Infrastructure (SAI) missing en...

Re: The splunk app for infrastructure cannot creat...

Re: The splunk app for infrastructure cannot creat...

Re: Splunk Insights for Infrastructure - adding wi...

Re: Splunk Insights for Infrastructure - adding wi...

Re: Splunk Insights for Infrastructure - adding wi...

Re: Splunk Insights for Infrastructure - adding wi...

Join the Conversation