Hello, I'm new with Splunk and still exploring how to use it. I was able to successfully create a Splunk Enterprise and Splunk Universal on two separate linux virtual machines. Now, my goal is to create monitoring metrics for cpu usage, etc. I've installed an App for Infrastructure and an add-on for infrastructure in the Splunk Enterprise VM. When adding entities, I can't install the generated linux command since I have restrictions for firewalls and kaspersky and etc. so I just followed this: [https://answers.splunk.com/answers/706010/in-the-splunk-app-for-infrastructure-can-you-use-e.html][1].
Instead of doing the windows version guide, I followed the one in Linux ([https://docs.splunk.com/Documentation/InfraApp/1.2.2/Admin/ManageAgents][2]. I've also added an inputs.conf and outputs.conf in my etc/apps/search/local of my splunk forwarder directory. Although when I restart my UF, there are still no entities in my Splunk Enterprise App. Can you help me with this? Thank you in advance!
Inputs.conf
[perfmon://CPU Load]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 30
object = Processor
index = em_metrics
_meta = os::"Linux"
[perfmon://Physical Disk]
counters = % Disk Read Time;% Disk Write Time
instances = *
interval = 30
object = PhysicalDisk
index = em_metrics
_meta = os::"Linux"
[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec;Packets Received/sec;Packets Sent/sec;Packets Received Errors;Packets Outbound Errors
instances = *
interval = 30
object = Network Interface
index = em_metrics
_meta = os::"Linux"
[perfmon://Available Memory]
counters = Cache Bytes;% Committed Bytes In Use;Page Reads/sec;Pages Input/sec;Pages Output/sec;Committed Bytes;Available Bytes
interval = 30
object = Memory
index = em_metrics
_meta = os::"Linux"
[perfmon://System]
counters = Processor Queue Length;Threads
instances = *
interval = 30
object = System
index = em_metrics
_meta = os::"Linux"
[perfmon://Process]
counters = % Processor Time;% User Time;% Privileged Time
instances = *
interval = 30
object = Process
index = em_metrics
_meta = os::"Linux"
[perfmon://Free Disk Space]
counters = Free Megabytes;% Free Space
instances = *
interval = 30
object = LogicalDisk
index = em_metrics
_meta = os::"Linux"
monitor:///var/log/syslog]
disabled = false
sourcetype = syslog
[monitor:///var/log/daemon.log]
disabled = false
sourcetype = syslog
[monitor:///var/log/auth.log]
disabled = false
sourcetype = syslog
[monitor:///var/log/apache/access.log]
disabled = false
sourcetype = combined_access
[monitor:///var/log/apache/error.log]
disabled = false
sourcetype = combined_access
[monitor:///opt/splunkforwarder/var/log/splunk/*.log]
disabled = false
index = _internal
[monitor:///etc/collectd/collectd.log]
disabled = false
index = _internal
Outputs.conf
[tcpout]
defaultGroup = splunk-app-infra-autolb-group
[tcpout:splunk-app-infra-autolb-group]
disabled = false
server = 192.168.56.110:9997
collectd.conf
#
# Config file for collectd(1).
# Please read collectd.conf(5) for a list of options.
# http://collectd.org/
#
##############################################################################
# Global
#
#----------------------------------------------------------------------------#
# Global settings for the daemon.
#
##############################################################################
Hostname "192.168.56.109"
#FQDNLookup true
#BaseDir "/var/lib/collectd"
#PIDFile "/var/run/collectd.pid"
#PluginDir "/usr/lib64/collectd"
#TypesDB "/usr/share/collectd/types.db"
#----------------------------------------------------------------------------#
# When enabled, plugins are loaded automatically with the default options #
# when an appropriate block is encountered.
#
# Disabled by default.
#
#----------------------------------------------------------------------------#
#AutoLoadPlugin false
#----------------------------------------------------------------------------#
# When enabled, internal statistics are collected, using "collectd" as the #
# plugin name.
#
# Disabled by default.
#
#----------------------------------------------------------------------------#
#CollectInternalStats false
#----------------------------------------------------------------------------#
# Interval at which to query values. This may be overwritten on a per-plugin #
# base by using the 'Interval' option of the LoadPlugin block:
#
#
#
# Interval 60
#
#
#
#----------------------------------------------------------------------------#
Interval 60
#MaxReadInterval 86400
#Timeout 2
#ReadThreads 5
#WriteThreads 5
# Limit the size of the write queue. Default is no limit. Setting up a limit is
# recommended for servers handling a high volume of traffic.
#WriteQueueLimitHigh 1000000
#WriteQueueLimitLow 800000
##############################################################################
# Logging
#
#----------------------------------------------------------------------------#
# Plugins which provide logging functions should be loaded first, so log #
# messages generated when loading or configuring other plugins can be #
# accessed.
#
##############################################################################
LoadPlugin syslog
LoadPlugin logfile
FlushInterval 10
##############################################################################
# LoadPlugin section
#
#----------------------------------------------------------------------------#
# Lines beginning with a single `#' belong to plugins which have been built #
# but are disabled by default.
#
#
#
# Lines beginning with `##' belong to plugins which have not been built due #
# to missing dependencies or because they have been deactivated explicitly. #
##############################################################################
#LoadPlugin csv
LoadPlugin cpu
LoadPlugin memory
LoadPlugin df
LoadPlugin load
LoadPlugin disk
LoadPlugin interface
##############################################################################
# Plugin configuration
#
#----------------------------------------------------------------------------#
# In this section configuration stubs for each plugin are provided. A desc- #
# ription of those options is available in the collectd.conf(5) manual page. #
##############################################################################
LogLevel info
File "/etc/collectd/collectd.log"
Timestamp true
PrintSeverity true
LogLevel info
ReportByCpu false
ReportByState true
ValuesPercentage true
ValuesAbsolute false
ValuesPercentage true
FSType "ext2"
FSType "ext3"
FSType "ext4"
FSType "XFS"
FSType "rootfs"
FSType "overlay"
FSType "hfs"
FSType "apfs"
FSType "zfs"
FSType "ufs"
ReportByDevice true
ValuesAbsolute false
ValuesPercentage true
IgnoreSelected false
ReportRelative true
Disk ""
IgnoreSelected true
UdevNameAttr "DEVNAME"
IgnoreSelected true
server "192.168.56.110"
port "8088"
token "SomeGUIDToken"
ssl true
verifyssl false
owner:admin
#Update Hostname, & in collectd.conf file above. Also, you can add dimensions as to write_splunk plugin (optional)"
[1]: https://answers.splunk.com/answers/706010/in-the-splunk-app-for-infrastructure-can-you-use-e.html
[2]: https://docs.splunk.com/Documentation/InfraApp/1.2.2/Admin/ManageAgents
↧