💠Splunk
StackState core integration
Last updated
StackState core integration
Last updated
This page describes StackState version 4.3.
The StackState 4.3 version range is End of Life (EOL) and no longer supported. We encourage customers still running the 4.3 version range to upgrade to a more recent release.
The StackState Splunk integration synchronizes events, metrics and topology data from Splunk to StackState. The integration uses the API Integration StackPack for events and metrics data, and the Splunk Topology StackPack for topology data.
The StackState API-Integration Agent periodically connects to the configured Splunk instance to execute Splunk saved searches:
If the Splunk Topology StackPack is installed, topology data is retrieved using the Splunk saved search configured in the Splunk topology Agent check.
Metrics data is retrieved using the Splunk saved search configured in the Splunk metrics Agent check.
Events data is retrieved using the Splunk saved search configured in the Splunk events Agent check.
The StackState API-Integration Agent pushes retrieved data and events to StackState:
The API Integration StackPack is required for all Splunk data.
Splunk topology data also requires the Splunk Topology StackPack to be installed.
StackState translates incoming data:
Topology data from the Splunk saved searches configured in the Splunk topology Agent check is translated into components and relations.
Metrics data from the Splunk saved search(es) configured in the Splunk metrics Agent check is available in StackState as a metrics telemetry stream.
Events from the Splunk saved search(es) configured in the Splunk events Agent check is available in StackState as a log telemetry stream.
API-Integration Agent installed on a machine that can connect to both Splunk and StackState.
A running Splunk instance.
A Splunk user account with access to Splunk saved searches. The user should have the capability search to dispatch and read Splunk saved searches.
To retrieve data from Splunk, the API Integration StackPack must be installed in your StackState instance. This is required for StackState to communicate with the API-Integration Agent and, once the required Splunk Agent checks have been configured, will directly make Splunk metrics and events available in StackState.
To retrieve topology data from Splunk, in addition to the API Integration StackPack, you will also need to install the Splunk Topology StackPack.
Install the Splunk Topology StackPack from the StackState UI StackPacks > Integrations screen. You will need to provide the following parameters:
Splunk instance name - A unique name to identify the Splunk instance in StackState.
Splunk API URL - The URL where the Splunk API can be reached. For example: http://splunk.network.local:8089.
The StackState API-Integration Agent must be configured with a Splunk Agent check for each type of data you want to retrieve from Splunk (topology, metrics and/or events).
Details of how to configure each of these checks can be found on the pages listed below:
Each Splunk check configured on the API-Integration Agent must include authentication details to allow the Agent to connect to your Splunk instance and execute the configured Splunk saved searches.
Two authentication mechanisms are available:
Token-based authentication supports Splunk authentication tokens. An initial Splunk token is provided in the Splunk check configuration. This initial token is used the first time the check starts, it is then exchanged for a new token. For details on using token based authentication with Splunk, see the Splunk documentation (docs.splunk.com).
Token-based authentication is preferred over HTTP basic authentication and will override basic authentication in case both are configured.
To enable token-based authentication, the following parameters should be included in the section authentcation.token_auth of each API-Integration Agent Splunk check configuration file:
name - Name of the user who will use this token.
initial_token - An initial, valid token. This token will be used once only and then replaced with a new generated token requested by the integration.
audience - The Splunk token audience.
token_expiration_days - Validity of the newly requested token. Default 90 days.
renewal_days - Number of days before a new token should be refreshed. Default 10 days.
The first time the check runs, the configured initial_token will be exchanged for a new token. After the configured renewal_days days, another new token will be requested from Splunk with a validity of token_expiration_days.
It is recommended to use token-based authentication.
With HTTP basic authentication, the username and password specified in the API-Integration Agent check configuration files are used to connect to Splunk. These parameters are specified in the section authentication.basic_auth of each API-Integration Agent Splunk check configuration file.
To check the status of the Splunk integration, run the status subcommand and look for splunk_topology, splunk_metrics and/or splunk_events under Running Checks:
The Splunk integration can retrieve the following data:
When the Splunk events Agent check is configured, events will be retrieved from the configured Splunk saved search or searches. Events retrieved from splunk are available in StackState as a log telemetry stream in the stackstate-generic-events data source. This can be mapped to associated components.
For details on how to configure the events retrieved, see the Splunk events check configuration.
When the Splunk metrics Agent check is configured, metrics will be retrieved from the configured Splunk saved search or searches. One metric can be retrieved from each saved search. Metrics retrieved from splunk are available in StackState as a metrics telemetry stream in the stackstate-metrics data source. This can be mapped to associated components.
For details on how to configure the metrics retrieved, see the Splunk metrics check configuration.
When the Splunk Topology StackPack is installed, and the Splunk topology Agent check is configured, topology will be retrieved from the configured Splunk saved search or searches.
For details on how to configure the components and relations retrieved, see the Splunk topology check configuration.
The StackState Splunk integration does not retrieve any trace data.
The StackState API-Integration Agent connects to the Splunk API at the endpoints listed below. The same endpoints are used to retrieve events, metrics and topology data.
| Endpoint | Description |
|---|---|
| Auth login |
| Create token |
| List of saved searches |
| Dispatch the saved search |
| Finalize the saved search |
For further details, see the Splunk API documentation (docs.splunk.com).
The Splunk Topology StackPack and the Agent checks for Splunk events, metrics and topology are open source and available on GitHub at the links below:
Troubleshooting steps for any known issues can be found in the StackState support Knowledge base.
To uninstall the Splunk topology StackPack, go to the StackState UI StackPacks > Integrations > Splunk topology screen and click UNINSTALL. All Splunk topology specific configuration will be removed from StackState.
For instructions on how to disable the Splunk Agent checks, see:
The Splunk Topology StackPack release notes are available on GitHub.
For the Splunk events and metrics synchronizations, see the API Integration StackPack release notes.
Configure the StackState API-Integration Agent Splunk checks:
Other resources:
