Splunk® Supported Add-ons

Splunk Add-on for New Relic

Download manual as PDF

Download topic as PDF

Configure inputs for the Splunk Add-on for New Relic

Configure data inputs to collect data from New Relic APM and New Relic Insights platforms. You can configure these inputs either by using Splunk Web or by editing local/inputs.conf.

Configure your data inputs on a data collection node, usually a heavy forwarder.

Create an input to collect data from New Relic APM

Collect APM information from the New Relic API. See Source types for the Splunk Add-on for New Relic for details about what data you can collect.

Choose a configuration option:

Configure the New Relic Account input in Splunk Web

  1. On your data collection node, access the Splunk Add-on for New Relic.
  2. Click Inputs.
  3. Click Create New Input > New Relic Account Inputs.
  4. In the Add New Relic Account Inputs window, complete the following fields.
    Setting Description
    Name A unique name that identifies the input.
    Interval Time interval to collect data, in seconds. Use an interval of less than 300 seconds if you are using this data with the Splunk ITSI Module for Application Performance Monitoring. The default is 60 seconds.
    Index The index in which to store the collected data.
    API Key An API key required to perform user accessible New Relic REST API operations
    If you have not generated a REST API key in New Relic, search for "API keys" in the New Relic documentation.
    API URL One or more API URL endpoints that specify which New Relic APM data to collect.
    Account ID The number that can be found in your New Relic URL. For example, https://rpm.newrelic.com/accounts/<New_Relic_account_number>/applications.
  5. Click Add.

Configure the New Relic Account input in inputs.conf

  1. On your data collection node, create or open your local inputs.conf file in your add-on directory:
    • $SPLUNK_HOME/etc/apps/Splunk_TA_New_Relic/local on Unix-based environments
    • %SPLUNK_HOME%\etc\apps\Splunk_TA_New_Relic\local on Windows environments
  2. Create input stanzas using the following template and example.
    Template:
    [new_relic_account_input://<unique_input_name>]
    account = <The number that can be found in your New Relic URL. >
    api_key = <Your API key, required to perform user accessible New Relic REST API operations. If you have not generated a REST API key in New Relic, search for "API keys" in the New Relic documentation.>
    api_url = <API URL endpoints that specify which New Relic APM data to collect, separated by ~. See the example for formatting and possible values.>
    interval = <Time interval in seconds to collect data. Use an interval of less than 300 seconds if you are using this data with the Splunk ITSI Module for Application Performance Monitoring. The default is 60 seconds.>
    index = <The index in which to store the collected data.>
    

    Example:

    [new_relic_account_input://example_input]
    account = 1234567
    api_key = ********
    api_url = applications.json~key_transactions.json~mobile_applications.json~browser_applications.json~servers.json~alerts_events.json~alerts_violations.json
    interval = 60
    index =newrelic
    
  3. Save the file.
  4. Restart the data collection node to encrypt your API key.

Create a New Relic Insights input

Collect event data directly from the Insights Query API through the add-on input configuration in Splunk Web, or in local/inputs.conf.

Choose a configuration option:

Configure the New Relic Insights input in Splunk Web

  1. On your data collection node, access the Splunk Add-on for New Relic.
  2. Click Inputs.
  3. Click Create New Input > New Relic Insights.
  4. In the Add New Relic Insights window, complete the following fields.
    Setting Description
    Name A unique name that identifies the input.
    Interval Time interval to collect data, in seconds. The default is 60 seconds.
    Index The index in which to store collected data.
    Account ID The number that can be found in your New Relic URL. For example, https://rpm.newrelic.com/accounts/<New_Relic_account_number>/applications.
    Insights API Key Your Insights API key, required to perform the Insights Query API operations.
    If you have not registered an Insights API key in New Relic, see Query Insights event data via API in the New Relic documentation.
    NRQL Query An NRQL query statement to execute.
    For information about NRQL (New Relic Query Language), refer to the New Relic documentation. The default is SELECT average(duration) FROM PageView SINCE 5 Minutes ago.
  5. Click Add.

Configure the New Relic Insights input in inputs.conf

  1. On your data collection node, create or open your local inputs.conf file in your add-on directory:
    • $SPLUNK_HOME/etc/apps/Splunk_TA_New_Relic/local on Unix-based environments
    • %SPLUNK_HOME%\etc\apps\Splunk_TA_New_Relic\local on Windows environments
  2. Create input stanzas using the following template and example.
    Template:
    [new_relic_insights://<unique_input_name>
    account_number = <The number that can be found in your New Relic URL.>
    insights_api_key = <n Insights API key, required to perform the Insights Query API operations.>
    interval = <Time interval in seconds to collect data. The default is 60 seconds.>
    index = <The index in which to store the collected data.>
    nrql_query = <An NRQL query statement to execute.>
    

    Example:

    [new_relic_insights://example_insights_input]
    account_number = 1234567
    insights_api_key = ********
    interval = 60
    index = newrelic
    nrql_query = SELECT average(duration) FROM PageView SINCE 5 Minutes ago
    
  3. Save the file.
  4. Restart the data collection node to encrypt your API key.
PREVIOUS
Set up the Splunk Add-on for New Relic
  NEXT
Troubleshoot the Splunk Add-on for New Relic

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Comments

Hi Chanfoli,
Thanks for your comment. The entry should be a list of of tilde-delimited .json endpoints, as you noted; the square brackets are not necessary. I have reached out to our Engineering team to advise of the confusion it caused to have square brackets in the form by default so we can address the issue in the UI. Many thanks--- Janet

Jrevell splunk, Splunker
October 19, 2017

The steps for entering collection urls in the input configuration page are not clear on the expected format. The form contains a pair of square brackets by default, and the inputs.conf example shows a list of tilde-delimited .json endpoints, so I am left wondering what to enter in the form given the brackets and lack of an example with multiple endpoints

Chanfoli
October 3, 2017

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters