Get metrics in from StatsD
StatsD has several implementations, some of which encode dimensions in different ways. The Splunk platform supports the following formats natively:
- Basic StatsD data line metric protocol
- Expanded StatsD data line metric protocol that includes dimensions
Basic StatsD metric protocol
The basic StatsD data line metric protocol has three fields: the
metric_name, the metric
_value, and the
metric_type. The Splunk platform supports one
g, for gauge metrics.
Expanded StatsD metric protocol
The expanded StatsD data line metric protocol supports dimensions.
For more about formats for metric names and dimensions, see Best practices for metrics.
Using other StatsD formats
If you use a StatsD implementation that uses a different format for dimensions from the ones that the Splunk platform supports natively, for example one that embeds dimensions within the metric name, you can still use metrics in the Splunk platform. However, you'll need to customize Splunk configuration files to specify how to extract dimensions from your format.
Another option is to use StatsD to gather metrics, but use collectd to send the data to the Splunk platform over HTTP. The benefit of this method is that collectd normalizes the dimension format in the metrics data. For more, see Get metrics in from collectd.
Set up a data input for StatsD data
After you configure your data source to send data in the StatsD protocol, create a UDP or TCP data input in the Splunk platform to listen for StatsD data on an open port.
- In Splunk Web, go to Settings > Data inputs.
- Under Local inputs, click Add new next to UDP or TCP, depending on the type of input you want to create.
- For Port, enter the number of the port you are using for StatsD.
- Click Next.
- Click Select Source Type, then select Metrics > statsd.
- For Index, select an existing metrics index. Or, click Create a new index to create one.
If you choose to create an index, in the New Index dialog box:
- Enter an Index Name. User-defined index names must consist of only numbers, lowercase letters, underscores, and hyphens. Index names cannot begin with an underscore or hyphen.
- For Index Data Type, click Metrics.
- Configure additional index properties as needed.
- Click Save.
- Click Review, then click Submit.
When using UDP ports to ingest metric data, you cannot use parallel ingestion or the multiple pipeline sets feature.
Get started with metrics
Extract dimensions for unsupported StatsD formats
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.2.0, 7.2.1