Configure Linux/Unix data collection for Splunk App for Infrastructure
To configure data collection, you must log in to an account with permissions to use sudo for root access. Do not log in as the root user.
Use the easy install script to install and configure data collection agents on a host you want to collect metrics and log data from. You can forward metrics and log data to the Splunk App for Infrastructure (SAI) to monitor performance and investigate your infrastructure. If you are running Docker containers without an orchestration tool like Docker Swarm, Kubernetes, or OpenShift, you can use the script to monitor the Docker containers as well.
To manually configure data collection, see Manually configure log collection on a *nix host for Splunk App for Infrastructure and Manually configure metrics collection on a *nix host for Splunk App for Infrastructure.
When you set up the data collection agent on your host machine, and validate new hosts are connected, you can start monitoring your infrastructure. Hosts you are monitoring are called entities. Go to the Investigate page to monitor your entities in the Tile or List view. You can group your entities to monitor them more easily and further analyze your infrastructure by drilling down to the Overview Dashboard for entities only or the Analysis Workspace for entities and groups.
For information about stopping or removing the data collection agents, see Stop data collection on Splunk App for Infrastructure.
Meet the following requirements to configure data collection:
See Operating system support for data collection in the Install and Upgrade Splunk App for Infrastructure guide.
|Data collection script||
See *nix data collection requirements in the Install and Upgrade Splunk App for Infrastructure guide.
|Administrator role||You must be an administrator to configure data collection.|
|HEC token||To create an HEC token, see Create an Event Collector token.
Follow these steps to configure and use the data collection script so that the host sends metrics and log data to SAI.
1. Specify configuration options
Select data collection options for collecting metrics and logs from your host.
- In the SAI user interface, click the Add Data tab and select Linux/Unix.
- Click Customize to select the metrics and log sources you want to collect data for. The
uptimemetrics are selected by default, and cannot be deselected.
- If you select cpu > Collect data for each CPU, metrics are stored for each CPU core, which enables you to split CPU usage by each core in the Analysis Workspace.
- If you select cpu > Collect sum over all CPUs, only aggregate metrics are stored for CPU usage.
dimension:value, such as
write_splunkcollectd plug-in creates these five dimensions:
8088if it is available.
--allow-unauthenticatedflag and imports the repository's signing key, enabling you to verify the source location of the collectd package. This setting applies only when installing on the following operating systems:
- Debian 7, 8
- Ubuntu 14, 16
/var/run/. The Docker socket is the UNIX socket Docker listens to for Docker API calls.
2. Copy and paste the easy install script into the command line of your host
Deploy the script on your host to collect metrics and logs.
If you're running Ubuntu 18.04.1 LTS and haven't enabled the
universe repository, the script may fail. Run these commands to enable the
univerise repository before running the script:
sudo apt-add-repository universe && sudo apt-get update
Follow these steps to deploy the script:
- Open a terminal window on the monitoring machine.
- Paste the script in the command line window.
- Run the script. When you run the script for the first time, you may receive a message stating that the universal forwarder was installed without creating an admin user. If this occurs, you have to manually create admin credentials. For information about configuring user credentials, see user-seed.conf in the Splunk Enterprise Admin Manual.
3. Verify your data connection
Verify your data connection to start monitoring your infrastructure. When the script finishes running, the user interface indicates your host is connected and data is available to view.
It can take up to about five (5) minutes for your hosts to display in the user interface.
- In the SAI user interface, click the Add Data tab.
- If no new hosts are connected after a few minutes, click Refresh.
- When new hosts are connected, click New host found to view your host.
Stop data collection on Splunk App for Infrastructure
Manually configure log collection on a *nix host for Splunk App for Infrastructure
This documentation applies to the following versions of Splunk® App for Infrastructure: 1.4.0, 1.4.1