Splunk Topology
StackState Self-hosted v5.1.x
Last updated
StackState v5.1
StackState Self-hosted v5.1.x
Last updated
When the is installed in StackState, you can configure the Splunk Topology check on StackState Agent V2 to begin collecting Splunk topology data.
The StackState Splunk Topology integration collects topology from Splunk by executing Splunk saved searches from . In order to receive Splunk topology data in StackState, configuration needs to be added to both Splunk and StackState Agent V2:
- there should be at least one saved search that generates the topology data you want to retrieve.
- a Splunk Topology check should be configured to connect to your Splunk instance and execute the relevant Splunk saved searches.
The Splunk Topology check on StackState Agent V2 will execute all configured Splunk saved searches periodically to retrieve a snapshot of the topology at the current time.
To run the Splunk Topology Agent check, you need to have:
A running Splunk instance.
The installed on your StackState instance.
must be installed on a single machine which can connect to Splunk and StackState.
The following fields from the results of a saved search are sent to StackState for topology components:
id (string)
Required. The unique identifier for the component.
name (string)
Required. The value will be used as the component name.
type (string)
Required. The type of component or relation.
labels (multivalue field or comma separated string)
The values will be added as labels on the component.
identifiers (multivalue field or comma separated string)
The values will be included as identifiers of the component.
All other fields
The example Splunk saved search above would result in the following topology component data in StackState:
id
Splunk id field.
name
Splunk name field.
type
Splunk type field.
labels
Splunk labels field
identifiers
Splunk identifiers field.
data
Splunk fields domain and layer.
The following fields from the results of a saved search are sent to StackState for topology relations:
type (string)
Required. The type of component or relation.
sourceId (string)
Reqruired. The ID of the component that is the source of the relation.
targetId (string)
Required. The ID of the component that is the target of the relation.
The example Splunk saved search above would result in the following topology relation data in StackState:
type
Splunk type field.
sourceId
Splunk sourceId field.
targetId
Splunk targetId field.
To enable the Splunk Topology integration and begin collecting component and relation data from your Splunk instance, the Splunk Topology check must be configured on StackState Agent V2. The check configuration provides all details required for the Agent to connect to your Splunk instance and execute a Splunk saved search.
To configure the Splunk Topology Agent check:
Edit the StackState Agent V2 check configuration file: /etc/stackstate-agent/conf.d/splunk_topology.d/conf.yaml
Under instances, add details of your Splunk instance:
url - The URL of your Splunk instance.
ignore_saved_search_errors - Set to false to return an error if one of the configured saved searches doesn't exist. Default true.
tags - Optional. Can be used to apply specific tags to all reported topology in StackState.
Under component_saved_searches, add details of each Splunk saved search that the check should execute to retrieve components:
match - Regex used for selecting Splunk saved search queries. Default "comp.*" for component queries and "relation*" for relation queries.
app - The Splunk app in which the saved searches are located. Default "search".
request_timeout_seconds - Default 10.
search_max_retry_count - Default 5.
search_seconds_between_retries - Default 1.
batch_size - Default 1000.
parameters - Used in the Splunk API request. The default parameters provided make sure the Splunk saved search query refreshes. Default force_dispatch: true and dispatch.now: true.
Under relation_saved_searches, add details of each Splunk saved search that the check should execute to retrieve relations.
Save the configuration file.
Restart StackState Agent V2 to apply the configuration changes.
Once the Agent has restarted, wait for the Agent to collect data and send it to StackState.
To disable the Splunk Topology Agent check:
Remove or rename the Agent integration configuration file, for example:
Restart StackState Agent V2 to apply the configuration changes.
In the Splunk Topology integration, StackState Agent V2 executes the Splunk saved searches configured in the and pushes retrieved data to StackState as components and relations. The fields from the results of a saved search that are sent to StackState are described below.
other than _time will be filtered out of the result. Any other fields present in the result will be available in StackState in the data field of the properties source tab for a component.
Example Agent V2 Splunk Topology check configuration file:
authentication - How the Agent should authenticate with your Splunk instance. Choose either token-based (recommended) or basic authentication. For details, see .
name - The name of the to execute.
More advanced options can be found in the .