How can I provide metrics to Splunk via HTTP?

半城伤御伤魂 提交于 2021-01-29 10:30:40

问题


I have been reading through Splunk Enterprise documentation and it appears I can provide metrics in JSON format over HTTP/HTTPS: https://docs.splunk.com/Documentation/Splunk/8.1.1/Metrics/GetMetricsInOther#Get_metrics_in_from_clients_over_HTTP_or_HTTPS

However I can't see a reference what exactly this JSON format looks like, beyond one example. I'm also not clear from the docs if Splunk can be configured to poll this endpoint on my process, or if I must push the data to Splunk.


回答1:


Splunk's HEC interface is receive-only. It does not poll.

Any time you find a Splunk documentation page that is unclear, submit feedback on it. Splunk's Docs team is great about updating the documents in response to feedback.

Let's look at the example payload from the documentation.

{
  "time": 1486683865,
  "source": "metrics",
  "sourcetype": "perflog",
  "host": "host_1.splunk.com",
  "fields": {
    "region": "us-west-1",
    "datacenter": "dc2",
    "rack": "63",
    "os": "Ubuntu16.10",
    "arch": "x64",
    "team": "LON",
    "service": "6",
    "service_version": "0",
    "service_environment": "test",
    "path": "/dev/sda1",
    "fstype": "ext3",
    "metric_name:cpu.usr": 11.12,
    "metric_name:cpu.sys": 12.23,
    "metric_name:cpu.idle": 13.34
  }
}

The time field is in *nix epoch form and says when the metric was collected. The source field identifies this as a metric. The value is free-text. The sourcetype field tells Splunk how to parse the payload. Your system may have a different source type configured for metrics. The host field identifies the server that generated the metrics. This is free-text. The fields section is where the metrics data goes. The measurements themselves are noted by the "metric_name:" prefix. The name of the metric is free-text. Splunk will treats dots within the metric name as a hierarchy separator.

Everything does not not begin with "metric_name:" is a dimension rather than a metric. Dimensions describe metrics and are optional.



来源:https://stackoverflow.com/questions/65565346/how-can-i-provide-metrics-to-splunk-via-http

标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!