LogoLogo
StackState.comDownloadSupportExplore playground
StackState v5.1
StackState v5.1
  • Welcome to the StackState docs!
  • StackState self-hosted v5.1 docs
  • Getting Started
  • 🚀Setup
    • Install StackState
      • Requirements
      • Kubernetes / OpenShift
        • Kubernetes install
        • OpenShift install
        • Required Permissions
        • Non-high availability setup
        • Override default configuration
        • Configure storage
        • Configure Ingress
        • Install from custom image registry
        • Migrate from Linux install
      • Linux
        • Before you install
        • Download
        • Install StackState
        • Install with production configuration
        • Install with development configuration
        • Install with POC configuration
        • Set up a reverse proxy
        • Set up TLS without reverse proxy
      • Initial run guide
      • Troubleshooting
    • Upgrade StackState
      • Steps to upgrade
      • Version specific upgrade instructions
      • StackPack versions
      • StackState release notes
    • StackState Agent
      • About StackState Agent V3
      • Docker
      • Kubernetes / OpenShift
      • Linux
      • Windows
      • Advanced Agent configuration
      • Use an HTTP/HTTPS proxy
      • Agent V1 (legacy)
      • Migrate Agent V1 to Agent V2
        • Linux
        • Docker
    • StackState CLI
      • CLI: sts
      • CLI: stac (deprecated)
      • Comparison between CLIs
    • Data management
      • Backup and Restore
        • Kubernetes backup
        • Linux backup
        • Configuration backup
      • Data retention
      • Clear stored data
  • 👤Use
    • Concepts
      • The 4T data model
      • Components
      • Relations
      • Health state
      • Layers, Domains and Environments
      • Perspectives
      • Anomaly detection
      • StackState architecture
    • StackState UI
      • Explore mode
      • Filters
      • Views
        • About views
        • Configure the view health
        • Create and edit views
        • Visualization settings
      • Perspectives
        • Topology Perspective
        • Events Perspective
        • Traces Perspective
        • Metrics Perspective
      • Timeline and time travel
      • Analytics
      • Keyboard shortcuts
    • Checks and monitors
      • Checks
      • Add a health check
      • Anomaly health checks
      • Monitors
      • Manage monitors
    • Problem analysis
      • About problems
      • Problem lifecycle
      • Investigate a problem
      • Problem notifications
    • Metrics
      • Telemetry streams
      • Golden signals
      • Top metrics
      • Add a telemetry stream
      • Browse telemetry
      • Set telemetry stream priority
    • Events
      • About events
      • Event notifications
      • Manage event handlers
    • Glossary
  • 🧩StackPacks
    • About StackPacks
    • Add-ons
      • Autonomous Anomaly Detector
      • Health Forecast
    • Integrations
      • About integrations
      • 💠StackState Agent V2
      • 💠AWS
        • AWS
        • AWS ECS
        • AWS X-ray
        • StackState/Agent IAM role: EC2
        • StackState/Agent IAM role: EKS
        • Policies for AWS
        • AWS (legacy)
        • Migrate AWS (legacy) to AWS
      • 💠Dynatrace
      • 💠Kubernetes
      • 💠OpenShift
      • 💠OpenTelemetry
        • About instrumentations
        • AWS NodeJS Instrumentation
        • Manual Instrumentation
          • Prerequisites
          • Tracer and span mappings
          • Relations between components
          • Span health state
          • Merging components
          • Code examples
      • 💠ServiceNow
      • 💠Slack
      • 💠Splunk
        • Splunk
        • Splunk Events
        • Splunk Health
        • Splunk Metrics
        • Splunk Topology
      • 💠VMWare vSphere
      • Apache Tomcat
      • Azure
      • Cloudera
      • Custom Synchronization
      • DotNet APM
      • Elasticsearch
      • Humio
      • Java APM
      • JMX
      • Logz.io
      • MySQL
      • Nagios
      • OpenMetrics
      • PostgreSQL
      • Prometheus
      • SAP
      • SCOM
      • SolarWinds
      • Static Health
      • Static Topology
      • Traefik
      • WMI
      • Zabbix
    • Develop your own StackPacks
  • 🔧Configure
    • Topology
      • Component actions
      • Identifiers
      • Topology naming guide
      • Topology sources
      • Create a topology manually
      • Configure topology synchronizations
      • Enable email event notifications
      • Send topology data over HTTP
      • Set the topology filtering limit
      • Use a proxy for event handlers
      • Use tags
      • Tune topology synchronization
      • Debug topology synchronization
    • Telemetry
      • Add telemetry during topology synchronization
      • Data sources
        • Elasticsearch
        • Prometheus mirror
      • Send events over HTTP
      • Send metrics data over HTTP
      • Set the default telemetry interval
      • Debug telemetry synchronization
    • Traces
      • Set up traces
      • Advanced configuration for traces
    • Health
      • Health synchronization
      • Send health data over HTTP
        • Send health data
        • Repeat Snapshots JSON
        • Repeat States JSON
        • Transactional Increments JSON
      • Debug health synchronization
    • Anomaly Detection
      • Export anomaly feedback
      • Scale the AAD up and down
      • The AAD status UI
    • Security
      • Authentication
        • Authentication options
        • File based
        • LDAP
        • Open ID Connect (OIDC)
        • KeyCloak
        • Service tokens
      • RBAC
        • Role-based Access Control
        • Permissions
        • Roles
        • Scopes
        • Subjects
      • Secrets management
      • Self-signed certificates
      • Set up a security backend for Linux
      • Set up a security backend for Windows
    • Logging
      • Kubernetes logs
      • Linux logs
      • Enable logging for functions
  • 📖Develop
    • Developer guides
      • Agent checks
        • About Agent checks
        • Agent check API
        • Agent check state
        • How to develop Agent checks
        • Connect an Agent check to StackState
      • Custom functions and scripts
        • StackState functions
        • Check functions
        • Component actions
        • Event handler functions
        • ID extractor functions
        • Mapping functions
        • Monitor functions
        • Propagation functions
        • Template functions
        • View health state configuration functions
      • Custom Synchronization StackPack
        • About the Custom Synchronization StackPack
        • How to customize elements created by the Custom Synchronization StackPack
        • How to configure a custom synchronization
      • Integrate external services
      • Mirroring Telemetry
      • Monitors
        • Create monitors
        • Monitor STJ file format
      • StackPack development
        • How to create a StackPack
        • Packaging
        • How to get a template file
        • How to make a multi-instance StackPack
        • Prepare a multi-instance provisioning script
        • Upload a StackPack file
        • Prepare a shared template
        • Customize a StackPack
        • Prepare instance template files
        • Prepare a StackPack provisioning script
        • Resources in a StackPack
        • StackState Common Layer
      • Synchronizations and templated files
    • Reference
      • StackState OpenAPI docs
      • StackState Template JSON (STJ)
        • Using STJ
        • Template functions
      • StackState Markup Language (STML)
        • Using STML
        • STML Tags
      • StackState Query Language (STQL)
      • StackState Scripting Language (STSL)
        • Scripting in StackState
        • Script result: Async
        • Script result: Streaming
        • Time in scripts
        • Script APIs
          • Async - script API
          • Component - script API
          • HTTP - script API
          • Prediction - script API
          • StackPack - script API
          • Telemetry - script API
          • Time - script API
          • Topology - script API
          • UI - script API
          • View - script API
    • Tutorials
      • Create a simple StackPack
      • Push data to StackState from an external system
      • Send events to StackState from an external system
      • Set up a mirror to pull telemetry data from an external system
Powered by GitBook
LogoLogo

Legal notices

  • Privacy
  • Cookies
  • Responsible disclosure
  • SOC 2/SOC 3
On this page
  • Overview
  • Prerequisites
  • Splunk saved search
  • Fields used
  • Example Splunk query
  • Agent check
  • Configure the Splunk Metrics check
  • Uniquely identify a record
  • Disable the Agent check
  • Splunk metrics in StackState
  • See also
  1. StackPacks
  2. Integrations
  3. Splunk

Splunk Metrics

StackState Self-hosted v5.1.x

PreviousSplunk HealthNextSplunk Topology

Last updated 2 years ago

Overview

This page describes the Splunk Metrics check running on StackState Agent V2.

If you are currently running the Splunk Metrics check on Agent V1 (legacy), it's advised that you migrate to Agent V2.

When the is installed in StackState, you can configure the Splunk Metrics check on StackState Agent V2 to begin collecting Splunk metrics data.

Metrics are collected from Splunk by executing Splunk saved searches that have been specified in the StackState Agent V2 Splunk Metrics check configuration. In order to receive Splunk metrics data in StackState, you will therefore need to add configuration to both Splunk and StackState Agent V2.

  • - there should be at least one saved search that generates the metrics data you want to retrieve. Each saved search can retrieve one metric.

  • - a Splunk Metrics check should be configured to connect to your Splunk instance and execute the relevant Splunk saved searches.

The Splunk Metrics check on StackState Agent V2 will execute all configured Splunk saved searches periodically. Data will be requested from the last received metric timestamp up until now.

Prerequisites

To run the Splunk Metrics Agent check, you need to have:

  • A running Splunk instance.

  • The installed on your StackState instance.

  • must be installed on a single machine which can connect to Splunk and StackState.

Splunk saved search

Fields used

Field
Description

_time (long)

Data collection timestamp, millis since epoch.

metric (string)

The name of the metric. Taken from the configured metric_name_field.

value (numeric)

The value of the metric. Taken from the configured metric_value_field.

Example Splunk query

index=vms MetricId=cpu.usage.average
| table _time VMName Value    
| eval VMName = upper(VMName)
| rename VMName as metricCpuUsageAverage, Value as valueCpuUsageAverage
| eval type = "CpuUsageAverage"
...
metric_name_field: "metricCpuUsageAverage"
metric_value_field: "valueCpuUsageAverage"
...

The example Splunk saved search above would result in the following metric data in StackState:

Field
Data

_time

Splunk _time field.

metric

Splunk <metricCpuUsageAverage> field.

value

Splunk <valueCpuUsageAverage> field.

Agent check

Configure the Splunk Metrics check

To enable the Splunk Metrics integration and begin collecting metrics data from your Splunk instance, the Splunk Metrics check must be configured on StackState Agent V2. The check configuration provides all details required for the Agent to connect to your Splunk instance and execute a Splunk saved search.

To configure the Splunk Metrics Agent check:

  1. Edit the StackState Agent V2 configuration file /etc/stackstate-agent/conf.d/splunk_metric.d/conf.yaml.

  2. Under instances, add details of your Splunk instance:

    • url - The URL of your Splunk instance.

    • tags - Optional. Can be used to apply specific tags to all reported metrics in StackState.

  3. Under saved_searches, add details of each Splunk saved search that the check should execute. Each saved search can retrieve one metric:

      • metric_name_field - The field in the Splunk results that will contain the metric name. Default "metric".

      • metric_value_field - The field in the Splunk results that will contain numerical data. Default "value".

      • match: - Regex used for selecting Splunk saved search queries. Default metrics.*.

      • app - The Splunk app in which the saved searches are located. Default "search".

      • request_timeout_seconds - Default 10

      • search_max_retry_count - Default 5

      • search_seconds_between_retries - Default 1

      • batch_size - Default 1000

      • initial_history_time_seconds - Default 0

      • max_restart_history_seconds - Default 86400

      • max_query_chunk_seconds - Default 3600

      • parameters - Used in the Splunk API request. The default parameters provided make sure the Splunk saved search query refreshes. Default force_dispatch: true and dispatch.now: true.

  4. Save the configuration file.

  5. Restart StackState Agent V2 to apply the configuration changes.

  6. Once the Agent has restarted, wait for the Agent to collect data and send it to StackState.

Uniquely identify a record

To prevent sending duplicate metrics over multiple check runs, received saved search records must be uniquely identified for comparison. By default, a record is identified by the Splunk default fields _bkt and _cd. This behavior can be customized for each saved search by specifying unique_key_fields in the Splunk Metrics Agent check configuration. Note that the specified unique_key_fields fields are mandatory fields for each record returned by the Splunk saved search.

If it isn't possible to uniquely identify a record by a combination of specific fields, the whole record can be used by setting unique_key_fields: [] (an empty list).

Disable the Agent check

To disable the Splunk Metrics Agent check:

  1. Remove or rename the Agent integration configuration file, for example:

     mv /etc/stackstate-agent/conf.d/splunk_metric.d/conf.yaml /etc/stackstate-agent/conf.d/splunk_metric.d/conf.yaml.bak
  2. Restart the StackState Agent to apply the configuration changes.

Splunk metrics in StackState

See also

StackState Agent V2 executes the Splunk saved searches configured in the and pushes retrieved data to StackState as a telemetry stream. The following fields from the results of a saved search are sent to StackState:

Example Agent V2 Splunk Metrics check configuration file:

authentication - How the Agent should authenticate with your Splunk instance. Choose either token-based (recommended) or basic authentication. For details, see .

name - The name of the to execute.

unique_key_fields - The fields to use to . Default _bkt and _cd.

More advanced options can be found in the .

Metrics retrieved from splunk are available in StackState as a metrics telemetry stream in the stackstate-metrics data source. This can be .

Metrics retrieved from splunk are available in StackState as a metrics telemetry stream in the stackstate-metrics data source. This can be .

🧩
💠
splunk_metric/conf.yaml.example (github.com)
example configuration (github.com)
mapped to associated components
mapped to associated components
StackState Splunk integration details
Map telemetry to components
Example Splunk Metrics configuration file - splunk_metric/conf.yaml.example (github.com)
Migrate to Agent V2
Documentation for the Splunk Metrics check running on Agent V1 (legacy)
Splunk StackPack
Splunk StackPack
StackState Agent v2.18 or later
Splunk saved search
StackState Agent V2 Splunk Metrics check
Splunk Metrics Agent check configuration file
Splunk saved search
uniquely identify a record
authentication configuration details