Comment on page
StackState Self-hosted v5.0.x
Events are collected from Splunk by executing Splunk saved searches that are configured in the StackState Agent V1 Splunk Events check. In order to receive Splunk events data in StackState, you will therefore need to add configuration to both Splunk and StackState Agent V1:
The Splunk Events check on StackState Agent V1 will execute all configured Splunk saved searches periodically. Data will be requested from the last received event timestamp up until now.
StackState Agent V1 executes the Splunk saved searches configured in the Splunk Events Agent check configuration file and pushes retrieved data to StackState as a telemetry stream. The following fields from the results of a saved search are sent to StackState:
Example Splunk query
| eval status = upper(status)
| search status=CRITICAL OR status=error OR status=warning OR status=OK
| table _time hostname status description
The example Splunk saved search above would result in the following event data in StackState:
To enable the Splunk Events integration and begin collecting events data from your Splunk instance, the Splunk Events check must be configured on StackState Agent V1. The check configuration provides all details required for the Agent to connect to your Splunk instance and execute a Splunk saved search.
To configure the Splunk Events Agent check:
- 1.Edit the StackState Agent V1 configuration file
- 2.Under instances, add details of your Splunk instance:
- url - The URL of your Splunk instance.
- tags - Optional. Can be used to apply specific tags to all reported events in StackState.
- 3.Under saved_searches, add details of each Splunk saved search that the check should execute:
- name - The name of the Splunk saved search to execute.
- match - Regex used for selecting Splunk saved search queries. Default
- app - The Splunk app in which the saved searches are located. Default
- request_timeout_seconds - Default
- search_max_retry_count - Default
- search_seconds_between_retries - Default
- batch_size - Default
- initial_history_time_seconds - Default
- max_restart_history_seconds - Default
- max_query_chunk_seconds - Default
- parameters - Used in the Splunk API request. The default parameters provided make sure the Splunk saved search query refreshes. Default
- 5.Save the configuration file.
- 6.Restart StackState Agent V1 to apply the configuration changes.
- 7.Once the Agent has restarted, wait for the Agent to collect data and send it to StackState.
To prevent sending duplicate events over multiple check runs, received saved search records must be uniquely identified for comparison. By default, a record is identified by the Splunk default fields
_cd. This behavior can be customized for each saved search by specifying
unique_key_fieldsin the Splunk Events Agent check configuration. Note that the specified
unique_key_fieldsfields are mandatory fields for each record returned by the Splunk saved search.
If it is not possible to uniquely identify a record by a combination of specific fields, the whole record can be used by setting
unique_key_fields: (an empty list).
To disable the Splunk Events Agent check:
- 1.Remove or rename the Agent integration configuration file, for example:mv conf.d/splunk_event.yaml conf.d/splunk_event.yaml.bak
- 2.Restart the StackState Agent(s) to apply the configuration changes.