Splunk® Enterprise


Acrobat logo Download manual as PDF

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Get metrics in from StatsD

StatsD is a network daemon that runs on the Node.js platform, sending metrics over UDP or TCP. For an overview of StatsD, see Measure Anything, Measure Everything on the Code as Craft website.

StatsD has several implementations, some of which encode dimensions in different ways. The Splunk platform supports the following formats natively:

  • Basic StatsD data line metric protocol
  • Expanded StatsD data line metric protocol that includes dimensions

Basic StatsD metric protocol

The basic StatsD data line metric protocol has three fields: the metric_name, the metric _value, and the metric_type. The Splunk platform supports one metric_type value: g, for gauge metrics.



Example metric


Expanded StatsD metric protocol

The expanded StatsD data line metric protocol supports dimensions.



Example metric

performance.os.disk:1099511627776|g|#region:us-west-1,datacenter:us-west-1a,rack:63,os:Ubuntu16.10,arch:x64,team:LON,service:6,service_version:0,service_environment:test, path:/dev/sdal,fstype:ext3

For more about formats for metric names and dimensions, see Best practices for metrics.

Using other StatsD formats

If you use a StatsD implementation that uses a different format for dimensions from the ones that the Splunk platform supports natively, for example one that embeds dimensions within the metric name, you can still use metrics in the Splunk platform. However, you'll need to customize Splunk configuration files to specify how to extract dimensions from your format.

Another option is to use StatsD to gather metrics, but use collectd to send the data to the Splunk platform over HTTP. The benefit of this method is that collectd normalizes the dimension format in the metrics data. For more, see Get metrics in from collectd.

Set up a data input for StatsD data

After you configure your data source to send data in the StatsD protocol, create a UDP or TCP data input in the Splunk platform to listen for StatsD data on an open port.

  1. In Splunk Web, go to Settings > Data inputs.
  2. Under Local inputs, click Add new next to UDP or TCP, depending on the type of input you want to create.
  3. When using UDP ports to ingest metric data, you cannot use parallel ingestion or the multiple pipeline sets feature.

  4. For Port, enter the number of the port you are using for StatsD.
  5. Click Next.
  6. Click Select Source Type, then select Metrics > statsd.
  7. For Index, select an existing metrics index. Or, click Create a new index to create one.
    If you choose to create an index, in the New Index dialog box:
    1. Enter an Index Name. User-defined index names must consist of only numbers, lowercase letters, underscores, and hyphens. Index names cannot begin with an underscore or hyphen.
    2. For Index Data Type, click Metrics.
    3. Configure additional index properties as needed.
    4. Click Save.
  8. Click Review, then click Submit.
Last modified on 07 December, 2018
Get started with metrics
Extract dimensions for unsupported StatsD formats

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters