LogoLogo
StackState.comDownloadSupportExplore playground
StackState v5.1
StackState v5.1
  • Welcome to the StackState docs!
  • StackState self-hosted v5.1 docs
  • Getting Started
  • 🚀Setup
    • Install StackState
      • Requirements
      • Kubernetes / OpenShift
        • Kubernetes install
        • OpenShift install
        • Required Permissions
        • Non-high availability setup
        • Override default configuration
        • Configure storage
        • Configure Ingress
        • Install from custom image registry
        • Migrate from Linux install
      • Linux
        • Before you install
        • Download
        • Install StackState
        • Install with production configuration
        • Install with development configuration
        • Install with POC configuration
        • Set up a reverse proxy
        • Set up TLS without reverse proxy
      • Initial run guide
      • Troubleshooting
    • Upgrade StackState
      • Steps to upgrade
      • Version specific upgrade instructions
      • StackPack versions
      • StackState release notes
    • StackState Agent
      • About StackState Agent V3
      • Docker
      • Kubernetes / OpenShift
      • Linux
      • Windows
      • Advanced Agent configuration
      • Use an HTTP/HTTPS proxy
      • Agent V1 (legacy)
      • Migrate Agent V1 to Agent V2
        • Linux
        • Docker
    • StackState CLI
      • CLI: sts
      • CLI: stac (deprecated)
      • Comparison between CLIs
    • Data management
      • Backup and Restore
        • Kubernetes backup
        • Linux backup
        • Configuration backup
      • Data retention
      • Clear stored data
  • 👤Use
    • Concepts
      • The 4T data model
      • Components
      • Relations
      • Health state
      • Layers, Domains and Environments
      • Perspectives
      • Anomaly detection
      • StackState architecture
    • StackState UI
      • Explore mode
      • Filters
      • Views
        • About views
        • Configure the view health
        • Create and edit views
        • Visualization settings
      • Perspectives
        • Topology Perspective
        • Events Perspective
        • Traces Perspective
        • Metrics Perspective
      • Timeline and time travel
      • Analytics
      • Keyboard shortcuts
    • Checks and monitors
      • Checks
      • Add a health check
      • Anomaly health checks
      • Monitors
      • Manage monitors
    • Problem analysis
      • About problems
      • Problem lifecycle
      • Investigate a problem
      • Problem notifications
    • Metrics
      • Telemetry streams
      • Golden signals
      • Top metrics
      • Add a telemetry stream
      • Browse telemetry
      • Set telemetry stream priority
    • Events
      • About events
      • Event notifications
      • Manage event handlers
    • Glossary
  • 🧩StackPacks
    • About StackPacks
    • Add-ons
      • Autonomous Anomaly Detector
      • Health Forecast
    • Integrations
      • About integrations
      • 💠StackState Agent V2
      • 💠AWS
        • AWS
        • AWS ECS
        • AWS X-ray
        • StackState/Agent IAM role: EC2
        • StackState/Agent IAM role: EKS
        • Policies for AWS
        • AWS (legacy)
        • Migrate AWS (legacy) to AWS
      • 💠Dynatrace
      • 💠Kubernetes
      • 💠OpenShift
      • 💠OpenTelemetry
        • About instrumentations
        • AWS NodeJS Instrumentation
        • Manual Instrumentation
          • Prerequisites
          • Tracer and span mappings
          • Relations between components
          • Span health state
          • Merging components
          • Code examples
      • 💠ServiceNow
      • 💠Slack
      • 💠Splunk
        • Splunk
        • Splunk Events
        • Splunk Health
        • Splunk Metrics
        • Splunk Topology
      • 💠VMWare vSphere
      • Apache Tomcat
      • Azure
      • Cloudera
      • Custom Synchronization
      • DotNet APM
      • Elasticsearch
      • Humio
      • Java APM
      • JMX
      • Logz.io
      • MySQL
      • Nagios
      • OpenMetrics
      • PostgreSQL
      • Prometheus
      • SAP
      • SCOM
      • SolarWinds
      • Static Health
      • Static Topology
      • Traefik
      • WMI
      • Zabbix
    • Develop your own StackPacks
  • 🔧Configure
    • Topology
      • Component actions
      • Identifiers
      • Topology naming guide
      • Topology sources
      • Create a topology manually
      • Configure topology synchronizations
      • Enable email event notifications
      • Send topology data over HTTP
      • Set the topology filtering limit
      • Use a proxy for event handlers
      • Use tags
      • Tune topology synchronization
      • Debug topology synchronization
    • Telemetry
      • Add telemetry during topology synchronization
      • Data sources
        • Elasticsearch
        • Prometheus mirror
      • Send events over HTTP
      • Send metrics data over HTTP
      • Set the default telemetry interval
      • Debug telemetry synchronization
    • Traces
      • Set up traces
      • Advanced configuration for traces
    • Health
      • Health synchronization
      • Send health data over HTTP
        • Send health data
        • Repeat Snapshots JSON
        • Repeat States JSON
        • Transactional Increments JSON
      • Debug health synchronization
    • Anomaly Detection
      • Export anomaly feedback
      • Scale the AAD up and down
      • The AAD status UI
    • Security
      • Authentication
        • Authentication options
        • File based
        • LDAP
        • Open ID Connect (OIDC)
        • KeyCloak
        • Service tokens
      • RBAC
        • Role-based Access Control
        • Permissions
        • Roles
        • Scopes
        • Subjects
      • Secrets management
      • Self-signed certificates
      • Set up a security backend for Linux
      • Set up a security backend for Windows
    • Logging
      • Kubernetes logs
      • Linux logs
      • Enable logging for functions
  • 📖Develop
    • Developer guides
      • Agent checks
        • About Agent checks
        • Agent check API
        • Agent check state
        • How to develop Agent checks
        • Connect an Agent check to StackState
      • Custom functions and scripts
        • StackState functions
        • Check functions
        • Component actions
        • Event handler functions
        • ID extractor functions
        • Mapping functions
        • Monitor functions
        • Propagation functions
        • Template functions
        • View health state configuration functions
      • Custom Synchronization StackPack
        • About the Custom Synchronization StackPack
        • How to customize elements created by the Custom Synchronization StackPack
        • How to configure a custom synchronization
      • Integrate external services
      • Mirroring Telemetry
      • Monitors
        • Create monitors
        • Monitor STJ file format
      • StackPack development
        • How to create a StackPack
        • Packaging
        • How to get a template file
        • How to make a multi-instance StackPack
        • Prepare a multi-instance provisioning script
        • Upload a StackPack file
        • Prepare a shared template
        • Customize a StackPack
        • Prepare instance template files
        • Prepare a StackPack provisioning script
        • Resources in a StackPack
        • StackState Common Layer
      • Synchronizations and templated files
    • Reference
      • StackState OpenAPI docs
      • StackState Template JSON (STJ)
        • Using STJ
        • Template functions
      • StackState Markup Language (STML)
        • Using STML
        • STML Tags
      • StackState Query Language (STQL)
      • StackState Scripting Language (STSL)
        • Scripting in StackState
        • Script result: Async
        • Script result: Streaming
        • Time in scripts
        • Script APIs
          • Async - script API
          • Component - script API
          • HTTP - script API
          • Prediction - script API
          • StackPack - script API
          • Telemetry - script API
          • Time - script API
          • Topology - script API
          • UI - script API
          • View - script API
    • Tutorials
      • Create a simple StackPack
      • Push data to StackState from an external system
      • Send events to StackState from an external system
      • Set up a mirror to pull telemetry data from an external system
Powered by GitBook
LogoLogo

Legal notices

  • Privacy
  • Cookies
  • Responsible disclosure
  • SOC 2/SOC 3
On this page
  • Overview
  • Setup
  • Prerequisites
  • Install
  • Configure
  • Authentication
  • Status
  • Integration details
  • Data retrieved
  • REST API endpoints
  • Open source
  • Troubleshooting
  • Uninstall
  • Release notes
  • See also
  1. StackPacks
  2. Integrations
  3. Splunk

Splunk

StackState Self-hosted v5.1.x

PreviousSplunkNextSplunk Events

Last updated 2 years ago

Overview

The StackState Splunk integration synchronizes events, metrics, health and topology data from Splunk to StackState. The integration uses to collect Splunk events, metrics, health and topology data.

Splunk is a .

  • StackState Agent V2 periodically connects to the configured Splunk instance to execute Splunk saved searches and retrieve data:

    • Topology data from the searches configured in the Splunk Topology Agent check.

    • Metrics data from the searches configured in the Splunk Metrics Agent check.

    • Events data from the searches configured in the Splunk Events Agent check.

    • Health data from the searches configured in the Splunk Health Agent check.

  • The Agents push retrieved data to StackState.

  • StackState translates incoming data:

Setup

Prerequisites

  • A running Splunk instance.

  • A Splunk user account with access to Splunk saved searches. The user should have the capability search to dispatch and read Splunk saved searches.

Install

The Splunk StackPack provides all the necessary configuration to easily work with Splunk topology data in StackState. Install the Splunk StackPack from the StackState UI StackPacks > Integrations screen. You will need to enter the following details:

  • Splunk instance name - A unique name to identify the Splunk instance in StackState.

  • Splunk API URL - The URL where the Splunk API can be reached. For example: http://splunk.network.local:8089.

After the StackPack has been installed, you should follow the instructions below to configure the required Splunk checks on StackState Agent V2.

Configure

A Splunk check must be configured on StackState Agent V2 for each type of data you want to retrieve from Splunk:

Authentication

Each Splunk check configured on StackState Agent V2 must include authentication details to allow the Agent to connect to your Splunk instance and execute the configured Splunk saved searches.

Two authentication mechanisms are available:

Token-based Authentication

Token-based authentication is preferred over HTTP basic authentication and will override basic authentication in case both are configured.

instances:
    - url: "https://localhost:8089"

    # username: "admin" ## deprecated
    # password: "admin" ## deprecated

    # verify_ssl_certificate: false

    authentication:
      token_auth:
        name: "api-user"
        initial_token: "my-initial-token-hash"
        audience: "search"
        token_expiration_days: 90
        renewal_days: 10

To enable token-based authentication, the following parameters should be included in the section authentcation.token_auth of each StackState Agent V2 Splunk check configuration file:

  • name - Name of the user who will use this token.

  • initial_token - An initial, valid token. This token will be used once only and then replaced with a new generated token requested by the integration.

  • audience - The Splunk token audience.

  • token_expiration_days - Validity of the newly requested token. Default 90 days.

  • renewal_days - Number of days before a new token should be refreshed. Default 10 days.

The first time the check runs, the configured initial_token will be exchanged for a new token. After the configured renewal_days days, another new token will be requested from Splunk with a validity of token_expiration_days.

HTTP basic authentication

With HTTP basic authentication, the username and password specified in the StackState Agent V2 check configuration files are used to connect to Splunk. These parameters are specified in the section authentication.basic_auth of each StackState Agent V2 Splunk check configuration file.

instances:
    - url: "https://localhost:8089"

    # username: "admin" ## deprecated - don't use
    # password: "admin" ## deprecated - don't use

    # verify_ssl_certificate: false

    authentication:
      basic_auth:
        username: "admin"
        password: "admin"

Status

To check the status of the Splunk integration, run the status subcommand and look for splunk_topology, splunk_metrics or splunk_events under Running Checks:

sudo stackstate-agent status

Integration details

Data retrieved

The Splunk integration can retrieve the following data:

Events

Metrics

Topology

When the Splunk StackPack is installed, and a Splunk Topology Agent check is configured, topology will be retrieved from the configured Splunk saved searches. The check that you should configure depends on the StackState Agent that you will use to retrieve topology data.

Health

When the Splunk Health Agent check is configured, health check states will be retrieved from the configured Splunk saved searches. Retrieved health check states are mapped to the associated components and relations in StackState.

Traces

The StackState Splunk integration doesn't retrieve any trace data.

REST API endpoints

StackState Agent V2 connects to the Splunk API at the endpoints listed below. The same endpoints are used to retrieve events, metrics and topology data.

Endpoint
Description

/services/auth/login?output_mode=json

Auth login

/services/authorization/tokens?output_mode=json

Create token

/services/saved/searches?output_mode=json&count=-1

List of saved searches

/servicesNS/<user>/<app>/saved/searches/<saved_search_name>/dispatch

Dispatch the saved search

/services/search/jobs/<saved_search_id>/control

Finalize the saved search

Open source

The Splunk StackPack and the Agent checks for Splunk Events, metrics and topology are open source and available on GitHub at the links below:

Troubleshooting

Uninstall

To uninstall the Splunk StackPack, go to the StackState UI StackPacks > Integrations > Splunk screen and click UNINSTALL. All Splunk topology specific configuration will be removed from StackState.

For instructions on how to disable the Splunk Agent checks, see:

Release notes

See also

Configure the StackState Agent V2 Splunk checks:

Other resources:

is translated into components and relations.

is available in StackState as a metrics telemetry stream.

are available in StackState as a log telemetry stream.

information is added to associated components and relations.

A compatible installed on a machine that can connect to both Splunk and StackState.

- to retrieve health data from Splunk

- to retrieve topology data from Splunk

- to retrieve events data from Splunk

- to retrieve metrics data from Splunk

Token-based authentication supports Splunk authentication tokens. An initial Splunk token is provided in the Splunk check configuration. This initial token is used the first time the check starts, it's then exchanged for a new token. For details on using token based authentication with Splunk, see the .

It's recommended to use .

When the Splunk Events Agent check is configured, events will be retrieved from the configured Splunk saved search or searches. Events retrieved from splunk are available in StackState as a log telemetry stream in the stackstate-generic-events data source. This can be .

For details on how to configure the events retrieved, see the .

When the Splunk Metrics Agent check is configured, metrics will be retrieved from the configured Splunk saved search or searches. One metric can be retrieved from each saved search. Metrics retrieved from splunk are available in StackState as a metrics telemetry stream in the stackstate-metrics data source. This can be .

For details on how to configure the metrics retrieved, see the .

For details on how to configure the components and relations retrieved, see the .

If you have an existing Splunk Topology integration configured to use StackState Agent V1 (legacy) and would like to upgrade to use StackState Agent V2, refer to the .

For details on how to configure the health retrieved, see the .

For further details, see the .

Troubleshooting steps for any known issues can be found in the .

The are available on GitHub.

- to retrieve health data from Splunk

- to retrieve topology data from Splunk

- to retrieve events data from Splunk

- to retrieve metrics data from Splunk

.

🧩
💠
StackState Agent V2
Splunk Health check
Splunk Topology check
Splunk Events check
Splunk Metrics check
Splunk documentation (docs.splunk.com)
mapped to associated components
Splunk Events check configuration
mapped to associated components
Splunk Metrics check configuration
Splunk Topology check configuration
Agent migration instructions
Splunk Health check configuration
Splunk API documentation (docs.splunk.com)
Splunk StackPack (github.com)
Splunk Topology check (github.com)
Splunk Metrics check (github.com)
Splunk Events check (github.com)
Splunk Health check (github.com)
StackState support Knowledge base
Splunk StackPack release notes
Splunk Health check
Splunk Topology check
Splunk Events check
Splunk Metrics check
Set up Splunk authentication with tokens (docs.splunk.com)
Splunk API documentation (docs.splunk.com)
Topology data
Metrics data
Events
Health
Token-based authentication (recommended)
HTTP basic authentication
token-based authentication
Events
Metrics
Topology
Health
StackState Agent V2
Disable the Splunk Topology Agent check
StackState core integration
Disable the Splunk Health Agent check
Disable the Splunk Events Agent check
Data flow
Disable the Splunk Metrics Agent check