Connect to external sensors using the MQTT protocol in the Splunk App for Edge Hub

You can connect your Splunk Edge Hub to external sensors or IIoT gateways that support the Message Queuing Telemetry Transport (MQTT) protocol.

You can configure MQTT settings in the Splunk App for Edge Hub version 4.9.0 and Splunk Edge OS version 2.1.0 or higher. You can also configure MQTT settings outside of the Splunk App for Edge Hub by using the Edge Hub advanced settings page. See Connect Splunk Edge Hub OS to external sensors using the MQTT protocol to learn more about using the MQTT protocol with Splunk Edge Hub and more configuration options.

Configure MQTT settings for a device

You can configure MQTT settings for a Splunk Edge Hub device. Complete these steps to access the MQTT configuration for your devices:

1. In the Splunk App for Edge Hub, navigate to the Devices page.
2. Select the device you want to configure the MQTT settings for.
3. Select Open Details.
4. Select Device Settings.
5. Configure MQTT settings by completing the steps that follow this section.
6. Select Save. The configuration deploys to the selected device.

To upload an existing configuration, select Spec during step 5. You can edit the configuration in the editor.

You can also configure MQTT settings from the Device Profile page. See Configure multiple Splunk Edge Hub devices using device profiles to access MQTT settings from a device profile.

Create a metric topic

Metric topics are ingress rules configured to ingest MQTT data sent to the Splunk platform as metric data. Complete the following steps to create a metric topic:

1. Navigate to a Device Profile or Device Settings for a device.
2. Select New Topic.
3. Configure the following fields:

Field	Description
Topic Name	Enter a MQTT topic for the Splunk Edge Hub OS to listen to.
Sensor Type	Used to describe the sensor_type dimension added to the generated Splunk metric. This value is metadata that you can use to filter your searches in Splunk software. Use a meaningful value to identify this particular sensor in a way that you can identify metrics coming from it in Splunk web.
(Optional) Description	This field is available to document any notes you may find relevant but are not supported by other fields.

Define a metric transformation

Metric transformations instruct the Splunk Edge Hub OS on how to parse MQTT data into metric values. Complete the following steps to define a metric transformation:

1. Navigate to a Device Profile or Device Settings for a device.
2. Select New Transformation.
3. Select Metric.
4. Configure the following fields:

Field	Description
Metric name	Name assigned to the generated metric.
(Optional) Unit	Unit of measurement for the generated metric.
Transformation Expression	Rule that transforms incoming messages to produce an int or float for the metric value.

Define a dimension transformation

Dimension transformations instruct the Edge Hub on how to parse MQTT data into values that will attach to Splunk metrics as additional dimensions. Complete the following steps to define a dimension transformation:

1. Navigate to a Device Profile or Device Settings for a device.
2. Select New Transformation.
3. Select Dimension.
4. Configure the following fields:

Field	Description
Dimension name	Name assigned to the generated dimension.
Transformation Expression	Rule that transforms incoming messages to produce a string value sent to the Splunk Platform.

Optionally, you can validate the transformation rule by forwarding a sample MQTT message from a Splunk Edge Hub device to your Splunk platform.

Define a timestamp transformation

Timestamp transformations instruct the Edge Hub on how to parse MQTT data for a timestamp value that will be used to set the timestamp of the Splunk metric. Complete the following steps to define a timestamp transformation:

1. Navigate to a Device Profile or Device Settings for a device.
2. Select New Transformation.
3. Select Timestamp.
4. Select Enable.
5. Configure the following fields:

Dimension name	Description
Transformation Expression	Rule that transforms incoming messages to produce an int value sent to the Splunk Platform as a timestamp.

Optionally, You can validate the transformation rule by forwarding a sample MQTT message from a Splunk Edge Hub device to your Splunk platform.

Create an event topic

Event topics are MQTT ingress rules configured to ingest and send MQTT data to the Splunk platform as event data. Complete the following steps to create an event topic:

1. Navigate to a Device Profile or Device Settings for a device.
2. Select New Topic.
3. Configure the following fields:

Field	Description
Topic Name	Enter a MQTT topic for the Splunk Edge Hub OS to listen to.
Index Name	The Splunk platform index that the Splunk Edge Hub OS will send data to.
(Optional) Description	This field is available to document any notes you may find relevant but are not supported by other fields.

Validate MQTT settings

You can remotely verify MQTT metric transformations by forwarding a sample MQTT message from a Splunk Edge Hub device to your Splunk platform:

1. Navigate to a Device Profile or Device Settings for a device.
2. Select MQTT configuration.
3. Select an existing metric topic or create a new one.
4. Select an existing transformation or create a new one.
5. Select an active Splunk Edge Hub device.
6. SelectRequest a sample message.
7. Ensure the selected Splunk Edge Hub device is receiving the sample message. Once the Splunk Edge Hub device forwards the message, the message appears in the Sample Message box.

Upload an existing MQTT configuration

You can upload or edit an existing MQTT configuration file:

1. In the Splunk App for Edge Hub, navigate to the Devices page.
2. Select the device you want to configure the MQTT settings for.
3. Select Open Details.
4. Select Device Settings.
5. Select Spec.
6. Drag and drop, copy and paste, or directly edit the configuration in the editor.
7. Select Save. The configuration deploys to the selected device.

To learn how to download a MQTT configuration file from another device and for more information such as configuration fields and sample values, see Download a configuration file and upload it to another Splunk Edge Hub device

Upgrading to Splunk Edge OS version 2.1.0 and Splunk App for Edge Hub version 4.9.0: sync existing MQTT configurations

When you upgrade a Splunk Edge Hub device with an existing MQTT configuration to Splunk Edge OS version 2.1.0 and Splunk App for Edge Hub version 4.9.0 for the first time, you must sync the MQTT configuration between the device and application:

1. Download the existing MQTT configuration from the Edge Hub advanced settings page. See Download a configuration file and upload it to another Splunk Edge Hub device to download a configuration file.
2. In the Edge Hub Advanced Settings page, select MQTT then Disable External MQTT Broker.
3. Upload the existing configuration in the Device Settings page.
4. When editing the configuration, remove all sensorId fields.
5. Select Save.

Optionally, you can upload the existing configuration to a device profile. See Configure multiple Splunk Edge Hub devices using device profiles to learn how. Then, apply the profile to the devices you want to use the MQTT protocol with.