Graphite Output for Splunk App - Enables Graphite Output for Splunk Searches, Events and Alerts.

Download via Splunk Base: <http://apps.splunk.com/app/1760/>

Usage

The Graphite Output for Splunk App has several operating modes:

1. As a Splunk Search Command "graphite", with optional paramaters:

   graphite [--host=HOST] [--port=PORT] [--namespace=NAMESPACE] [--prefix=PREFIX] [--namefield=FIELD] [--noop] [field1 field2 ...]
       --host HOST: Send metrics to HOST. Default: `localhost
       --port PORT: Send metrics to TCP PORT on Graphite host. Default: `2003`
       --namespace NAMESPACE: Prepend metrics with NAMESPACE. Default: `splunk.search`
       --prefix PREFIX: Prepend metrics namespace with PREFIX. Default: None.
       --namefield FIELD: Prepend the metric name with the value of this field. Default: None
       --noop: Test run - Show what would be done, but don't do it.
   
       field1 field2 ...: Output specified fields to Graphite. Default: All int & float fields.
   

2. As a Splunk Saved Search Alert: "graphite.py".

3. As a Splunk Event Action: "Graphite Output".

Use Cases

The following use cases do not require any App configuration:

Use Case 1: A Search Command sending all metrics to a specified host:

1. Search for events containing metrics you'd like to export to graphite:

   > search meter
   1396998727 meter=275
   1396998722 meter=67
   1396998717 meter=165
   

2. Append 'graphite' to the search command, using '--host=' to specify the destination host:

   > search meter | graphite --host=graphite.example.com
   

Use Case 2: A Search Command sending a specific metric to a specified host:

1. Search for events containing metrics you'd like to export to graphite, as well as metrics you don't want to send to graphite:

   > search meter
   1396999098 temperature=267 meter=86
   1396999093 temperature=118 meter=258
   1396999088 temperature=189 meter=290
   ...
   

2. Append the graphite search command with --host= to specify the destination host and meter to specify that you only want to send the meter metric:

   > search meter | graphite --host=graphite.example.com meter
   

3. Append the graphite search command with --namefield= to specify a field that contains the metric name prefixes:

   > search meter
   | bucket _time span=10s
   | stats
     avg(meter) as meter.mean
     max(meter) as meter.max
     by _time,name
   | graphite --namefield=name meter.mean meter.max
   

Use Case 3: A Search Command sending a specific metric to a specified host with a specified event as metrics prefix:

1. Search for events containing metrics you'd like to export to graphite, as well as metrics you don't want to send to graphite:

   > search meter
   1396999098 temperature=267 meter=86
   1396999093 temperature=118 meter=258
   1396999088 temperature=189 meter=290
   ...
   

2. Append the graphite search command with --host= to specify the destination host and meter to specify that you only want to send the meter metric:

   > search meter | graphite --host=graphite.example.com meter
   

3. Append the graphite search command with --namefield= to specify a field that contains the metric name prefixes:

   > search meter
   | bucket _time span=10s
   | stats
     avg(meter) as meter.mean
     max(meter) as meter.max
     by _time,name
   | graphite --namefield=name meter.mean meter.max
   

The following use cases require App configuration:

Apps > Manage Apps > Graphite Output > Set up:

Use Case 3: As a Event Action:

1. Search for events containing metrics you'd like to export to graphite:

   > search meter
   1396999098 temperature=267 meter=86
   1396999093 temperature=118 meter=258
   1396999088 temperature=189 meter=290
   ...
   

2. Click > > Event Actions > Graphite Output pull-down to export events to your App configured graphite destination:

   

Use Case 4: As a Saved Search Alert Script:

1. Search for events containing metrics you'd like to export to graphite:

   > search meter
   1396999098 temperature=267 meter=86
   1396999093 temperature=118 meter=258
   1396999088 temperature=189 meter=290
   ...
   

2. Create a Alert: Save As > Alert.

   

3. Enter Alert paramaters and click Next:

   

4. Select Run a Script and enter graphite.py, then click Save.

   

Testing & Development

This app requires Vagrant and a Python environment to test and develop.

To test this App:

$ make vagrant_up
$ make test

Source

https://github.com/OnBeep/splunk_graphite

Author

• Greg Albrecht <oss@undef.net>

Contributors

• Greg Albrecht - https://github.com/ampledata
• Christian Ruschke - https://github.com/cruschke
• Nathaniel Waisbrot - https://github.com/waisbrot
• David Narayan - https://github.com/davidnarayan

Copyright

• Copyright 2016 Orion Labs, Inc.

License

Apache License, Version 2.0

See LICENSE