Send collectd data to a local universal forwarder

Configure collectd to send metrics data to a universal forwarder. If you already have firewall rules and ports set up for a local universal forwarder, you can use those same settings to send metrics data from collectd through the local universal forwarder to the Splunk App for Infrastructure (SAI). This makes it easier to monitor an entity in a closed network or large environment without creating new rules and ports.

Prerequisites

To send collectd data to a universal forwarder, you must have already completed these steps:

• Configure collectd. For more information, see Manually configure metrics collection on a *nix host for Splunk App for Infrastructure.
• Install a universal forwarder. For more information, see Install a *nix universal forwarder in the Forwarder Manual.
• Set up the universal forwarder to send data to SAI. For more information, see Manually configure log collection on a *nix host for Splunk App for Infrastructure

To send metrics data from collectd to the universal forwarder, configure a UDP port for the local universal forwarder and modify the write_splunk plug-in in collectd.conf.

Steps

Follow these steps to start sending collectd data to a local universal forwarder.

1. Add a network input

Configure a UDP input in $SPLUNKFORWARDERHOME/etc/system/local/inputs.conf so that the universal forwarder can receive data from collectd. Add this stanza with the following attributes:

[udp://{UDP_PORT}]
index = em_metrics
sourcetype = em_metrics_udp
no_appending_timestamp = true

If you are using a different index for metrics, replace em_metrics with the custom index.

For more information about configuring a UDP input, see Add a network input using inputs.conf in the Splunk Enterprise Getting Data In manual.

2. Modify the write_splunk plug-in

Add this stanza to collectd.conf. To find your collectd.conf file, see collectd package sources, install commands, and locations.

<LoadPlugin "write_splunk">
FlushInterval 30
</LoadPlugin>

In collectd.conf, modify the write_splunk plug-in:

<Plugin write_splunk>
server "{UF hostname, IP, or localhost}"
buffersize 9000
useudp true
udpport {UDP_PORT}
</Plugin>

buffersize is the size (in bytes) of the Send Buffer that the write_splunk plug-in uses. You can increase the buffersize if your operating system supports it.

3. Restart the universal forwarder and collectd

Restart the universal forwarder:

./splunk restart

Restart collectd:

sudo service collectd restart