Connects Splunk to Stackstate in order to:
The StackState Agent can execute splunk queries and convert the result to topology elements, which are then synchronized to StackState. The StackState Agent expects the
saved searches to return the latest snapshot of the topology.
In order for the StackState Agent to be able to convert the results to topology elements, the output of the query has to be according to the format below. The format describes specific columns in the output that, when present, are used for the topology element. Other columns that are present in the output format, not defined in the query format, are available as key-value-pairs in StackState inside the
data map. The column names are used as keys and the content as value. Splunk internal fields are filtered out by the StackState Agent)
|id||string||The unique identifier for this component.|
|type||string||The type of the component.|
|name||string||The value will be used as component name.|
|identifier.<identifier name>||string||The value will be included as identifier of the component.|
|label.<label name>||string||The value will appear as label of the component.|
* This format assumes you use the default splunk mapping function and identity extractor in StackState. By customizing these you can create your own format.
|type||string||The type of the relation.|
|sourceId||string||The id of the component that is the source of this relation.|
|targetId||string||The id of the component that is the target of this relation.|