Sending Sensu Metrics to Splunk

username123 · April 12, 2021, 5:58pm

Is there any way to send sensu metrics over to splunk?

calebhailey · April 12, 2021, 6:51pm

Here’s an example using a Sensu socket handler and the Splunk Universal Forwarder:

sensu/catalog/blob/main/pipelines/event-storage/splunk_tcp.yaml

---
# Description
#   The Sensu Splunk TCP Handler is a Sensu Event Handler that sends events to
#   be indexed in Splunk via a Universal Forwarder.
#
# Instructions
#   1. Add "splunk_tcp" to the "event-storage" handler set.
#
#      To create the "event-storage" handler set, please run:
#
#      $ sensuctl handler create event-storage --type set --handlers splunk_tcp
#
#      If you already have a handler set called "event-storage", please run:
#
#      $ sensuctl edit handler event-storage
#
#      NOTE: the sensuctl edit command will open your default editor; please
#      modify the "handlers" attribute by adding "splunk_tcp".
#
#   2. You will need to configure a Splunk Universal Forwarder to listen on a

This file has been truncated. show original

This template assumes the Splunk Universal Forwarder is installed on all Sensu backend nodes, and simply forwards Sensu formatted events to Splunk (unless you’re also using a mutator to modify event payloads).

username123 · April 13, 2021, 4:41pm

I can’t seem to get it working. I have attached a screenshot of my sensu handler as well as my splunk input.conf file. The host on the sensu handler is not actually 123.123.123.123, I just put that so that I do not reveal my actual host. However the host I actually used is the ip address of the first sensu backend node in my cluster where I also have the input.conf configured for.

username123 · April 13, 2021, 4:41pm

test_splunk_inputs

username123 · April 13, 2021, 4:43pm

What I am expecting to see is some recognizable output in the Splunk Search with the sourcetype of “sensu”. Is that right to assume or should I be expecting to see the metrics in a different way?

gkiran.ch · May 28, 2021, 11:29am

@username123 were you able to get your setup working with splunk. If so, can you provide the steps you have followed

Topic		Replies	Views
Recommendations on how to migrate metrics checks Sensu Go	0	671	May 15, 2019
Sensu-Go integration mechanisms? Sensu Go	2	609	August 24, 2020
sensu metrics to logstash Sensu Classic (EOL)	2	403	November 22, 2018
Using Prometheus as a TSDB for Sensu Go Sensu Go	4	819	July 26, 2020
Send metrics to datadog Sensu Classic (EOL)	0	482	August 17, 2016

Sending Sensu Metrics to Splunk

Related Topics