Comment on page
Splunk Topology V2
StackState Self-hosted v5.0.x
The StackState Splunk Topology V2 integration collects topology from Splunk by executing Splunk saved searches from StackState Agent V2. In order to receive Splunk topology data in StackState, configuration needs to be added to both Splunk and StackState Agent V2:
The Splunk topology check on StackState Agent V2 will execute all configured Splunk saved searches periodically to retrieve a snapshot of the topology at the current time.
In the Splunk Topology V2 integration, StackState Agent V2 executes the Splunk saved searches configured in the Splunk Topology V2 Agent check and pushes retrieved data to StackState as components and relations. The fields from the results of a saved search that are sent to StackState are described below.
The following fields from the results of a saved search are sent to StackState for topology components:
Splunk query for components
| datamodel uberAgent60m System_MachineInventory search
| dedup host
| eval id = upper(host) | strcat "urn:host:/" id identifier
| eval name = 'id'
| eval type="host"
| eval domain="uberAgent"
| eval layer="Machines"
| eval labels=split("uberAgent", ",")
| eval identifiers=mvappend(identifier, id)
| table id type name domain layer labels identifiers
The example Splunk saved search above would result in the following topology component data in StackState:
The following fields from the results of a saved search are sent to StackState for topology relations:
Splunk query for relations
| datamodel uberAgent60m Application_ApplicationInventory search
| rename Application_ApplicationInventory.DisplayName as appname
| table host appname | uniq
| eval host_id = upper(host) | strcat "urn:host:/" host_id targetId
| eval app_id = upper(appname) | rex mode=sed field=app_id "s/ /_/g"
| strcat "urn:application:/" app_id sourceId
| eval type="runs_on"
| table type sourceId targetId | dedup sourceId targetId
The example Splunk saved search above would result in the following topology relation data in StackState:
To enable the Splunk Topology V2 integration and begin collecting component and relation data from your Splunk instance, the Splunk Topology V2 check must be configured on StackState Agent V2. The check configuration provides all details required for the Agent to connect to your Splunk instance and execute a Splunk saved search.
To configure the Splunk topology Agent check:
- 1.Edit the StackState Agent V2 check configuration file:
- 2.Under instances, add details of your Splunk instance:
- url - The URL of your Splunk instance.
- ignore_saved_search_errors - Set to
falseto return an error if one of the configured saved searches does not exist. Default
- tags - Optional. Can be used to apply specific tags to all reported topology in StackState.
- 3.Under component_saved_searches, add details of each Splunk saved search that the check should execute to retrieve components:
- name - The name of the Splunk saved search to execute.
- match - Regex used for selecting Splunk saved search queries. Default
"comp.*"for component queries and
"relation*"for relation queries.
- app - The Splunk app in which the saved searches are located. Default
- request_timeout_seconds - Default
- search_max_retry_count - Default
- search_seconds_between_retries - Default
- batch_size - Default
- parameters - Used in the Splunk API request. The default parameters provided make sure the Splunk saved search query refreshes. Default
- 4.Under relation_saved_searches, add details of each Splunk saved search that the check should execute to retrieve relations.
- 6.Save the configuration file.
- 7.Restart StackState Agent V2 to apply the configuration changes.
- 8.Once the Agent has restarted, wait for the Agent to collect data and send it to StackState.
To disable the Splunk topology Agent check:
- 1.Remove or rename the Agent integration configuration file, for example:mv /etc/stackstate-agent/conf.d/splunk_topology.d/conf.yaml /etc/stackstate-agent/conf.d/splunk_topology.d/conf.yaml.bak
- 2.Restart StackState Agent V2 to apply the configuration changes.