Splunk monitor

Available in versions: 25.3 and later

The integration with Splunk enables you to view metrics collected by the Splunk Application Performance Monitoring (APM) tool. The data is displayed in online and offline graphs and in Analysis.

In this topic:

Set up the Splunk monitor

Set up the Splunk monitor to request reported data from Splunk APM. For each Splunk host, you define the metrics for which you want to view data.

To set up the Splunk monitor:

1. Select a resources folder for the monitor profile in the resources tree, or create a new folder as follows:

   1. In the banner, click the module name or arrow and select Assets > Monitors.

   2. Click the New Folder button and enter a name for the monitor resources folder.

2. Create a monitor profile.

   1. Click the New Monitor Profile button , and make sure Monitor Profile is selected.

   2. Enter a name and optional description for the monitor profile, and click Save. An empty monitor profile is added to the selected resources folder.

   3. Select the monitor profile you just added and click the Add Monitor button .

   4. In the Monitor Type Selection tab, select the Splunk monitor type and click Next.

   5. In the Monitor Definition tab, enter the server details.

      Field	Details
      Server	The Splunk server address (IP or FQDN).
      Port	The port used to connect to Splunk. By default, port 8089 is used.
      Use HTTPS	Select to use HTTPS when connecting to Splunk. By default, HTTPS must be used.
      Username	Splunk username.
      Password	Splunk password.

   6. Click Select Index and select the index you want to include in the monitor. While there are two types of indexes, metrics and events, only metrics indexes are supported in the monitor graph.

   7. Click Select Host and select the host you want to include in the monitor.

   8. Click Get Counters to display a list of available metrics and counters from the selected Splunk application.

      Select the measurements that you want to monitor, and then click to add the counters to the Selected Counters table.

   9. Click Save. The monitor details are displayed in the Monitors tab for the selected monitor profile.

   10. (Optional) The Splunk data points are sent every 60 seconds. To ensure all available data is displayed, we recommend setting the graph to show the results from a larger time frame, such as the entire performance test.

       • In the Splunk graph display box, click the Configuration button and select Settings.

       • In the settings pane, set Graph Time to Whole Load Test.

       • Click Save.

       When you run the test, after some brief processing, Controller displays metrics in the Splunk graph.

       Note:  

       • It takes a few minutes until valid data is received for the test in progress. After this delay, the graph starts displaying metrics, using the timestamps from the Splunk machine. The timestamps for the data points in the graph are therefore a few minutes older than the time on the Controller machine.

       • If you set up the monitor using the over-firewall components, the MI Listener uses the timestamp of the request for data, and not the Splunk timestamp for the metrics. Therefore, you do not see a delay for the data points in the graph.

         In addition, the data points in the graph are more frequent than the data collected by Controller, due to the more frequent polling rate defined on the MOFW machine.

         For details, see Install and configure servers and hosts.

Back to top

See also:

• Monitors