Get metrics in from StatsD

StatsD is a network daemon that runs on the Node.js platform, sending metrics over UDP or TCP. For an overview of StatsD, see Measure Anything, Measure Everything on the Code as Craft website.

StatsD has several implementations, some of which encode dimensions in different ways. The Splunk platform supports the following formats natively:

• Basic StatsD data line metric protocol
• Expanded StatsD data line metric protocol that includes dimensions

Basic StatsD metric protocol

The basic StatsD data line metric protocol has three fields: the metric_name, the metric _value, and the metric_type. The Splunk platform supports one metric_type value: g, for gauge metrics.

Syntax

<metric_name>:<_value>|<metric_type>

Example metric

performance.os.disk:1099511627776|g

Expanded StatsD metric protocol

The expanded StatsD data line metric protocol supports dimensions.

Syntax

<metric_name>:<_value>|<metric_type>|#dim1:valueX,dim2:valueY

Example metric

performance.os.disk:1099511627776|g|#region:us-west-1,datacenter:us-west-1a,rack:63,os:Ubuntu16.10,arch:x64,team:LON,service:6,service_version:0,service_environment:test, path:/dev/sdal,fstype:ext3

For more about formats for metric names and dimensions, see Best practices for metrics.

Using other StatsD formats

If you use a StatsD implementation that uses a different format for dimensions from the ones that the Splunk platform supports natively, for example one that embeds dimensions within the metric name, you can still use metrics in the Splunk platform. However, you'll need to customize Splunk configuration files to specify how to extract dimensions from your format.

Another option is to use StatsD to gather metrics, but use collectd to send the data to the Splunk platform over HTTP. The benefit of this method is that collectd normalizes the dimension format in the metrics data. For more, see Get metrics in from collectd.

Set up a data input for StatsD data

After you configure your data source to send data in the StatsD protocol, create a UDP or TCP data input in the Splunk platform to listen for StatsD data on an open port.

1. In Splunk Web, go to Settings > Data inputs.
2. Under Local inputs, click Add new next to UDP or TCP, depending on the type of input you want to create.

When using UDP ports to ingest metric data, you cannot use parallel ingestion or the multiple pipeline sets feature.

3. For Port, enter the number of the port you are using for StatsD.
4. Click Next.
5. Click Select Source Type, then select Metrics > statsd.
6. For Index, select an existing metrics index. Or, click Create a new index to create one.
   If you choose to create an index, in the New Index dialog box:
   1. Enter an Index Name. User-defined index names must consist of only numbers, lowercase letters, underscores, and hyphens. Index names cannot begin with an underscore or hyphen.
   2. For Index Data Type, click Metrics.
   3. Configure additional index properties as needed.
   4. Click Save.
7. Click Review, then click Submit.