Splunk app for Solarwinds

I am currently learning Splunk and found that an app was recently released to display Solarwinds data inside Splunk. I have created a simple dashboard with some pretty generic stats.

Has anyone else had a chance to use this app,and if so what have you done with it?

Find more posts tagged with

daashboard

splunk

API

Accepted answers

All comments

sja

Nice

Can it display the alerts and events?

/Sja

solaradmin

It has 3 data input options

Solarwinds Query -Queries the SW database.

Solarwinds Alerts- This seems to be events not so much actual alerts. Still looking into

Solarwinds Node Inventory.- Gather node info using api.

mprobus

I am currently learning Splunk. I don't have admin access to Splunk actually install the app, but I'm curious as to what you get out of it so I can push for it to be installed.

bobmarley

Thanks for the post. It does look like it will bring in anything you want with the generic data input.

Here is the description from splunkbase.

"The Splunk Add-on for SolarWinds allows a Splunk software administrator to collect SolarWinds alerts and SolarWinds asset inventory (network devices and their various attributes). This add-on also includes a generic input that allows you to schedule any SolarWinds query and index the corresponding output in Splunk.

You can then directly analyze the data or use it as a contextual data feed to correlate with other application performance-related data in the Splunk platform."

About

With the SolarWinds add-on for Splunk, you have the ability to ingest the following SolarWinds data sources:

1- SolarWinds alerts
2- SolarWinds asset Inventory (network devices and their various attributes)
3- SolarWinds queries which is a generic data input that allows you to index the output of any SolarWinds select statement/query

Installation

Deploy the spl file as a splunk app from Splunk Web using "Install App from File".

Configuration

Using Splunk web go to “SolarWinds Add-on for Splunk” App
Click on “Configuration” tab
Enter the Credentials under the “Account” tab. These are the credentials needed to authenticate to the SolarWinds API. The username/password used should have the minimum permission needed to run the SolarWinds query via REST API
Enter the Solarwinds Server and port under “Add-on Settings”
Configure proxy if you have proxy between Splunk and SolarWinds

Starting Data collection

Click on “Input” Tab from within the “SolarWinds Add-on for Splunk” App
Add new Input. You have 3 types:
- SolarWinds Alerts: This is an incremental poll that keeps track of last alert indexed in checkpoint file and queries the deltas for just the new alerts on next poll iteration. To configure, select the account used for authentication. Set the initial start time. Format allowed should follow "yyyy-MM-dd hh:mm:ss.%3f" for example “2017-01-16 10:15:01.54”.
- SolarWinds Node Inventory (network devices and their various attributes): This is snapshot poll. This input allows you to take a snapshot of all assets at every poll. We recommend keeping the poll interval high 12h (43200 seconds) or higher
- SolarWinds Query: This is a generic data input that allows you to index the output of any SolarWinds select statement/query. You can enter any SolarWinds select statement and index the output in splunk. This is snapshot poll as well so we recommend keeping the poll interval high as well

Release Notes

Version 1.0.0

June 9, 2017

solaradmin

I do have it setup and working. I was just hoping others could tell me what they were doing with it or share their dashboards.

bobmarley

I think the possibilities are pretty endless using the generic data input. I don't have it installed yet but plan on doing it on our lab system soon.

solaradmin

They are indeed endless yet at the same time I'm lost as to what data i want to display

bobmarley

I finally installed it. Not so much to make displays, i just want to automate compares of tables from other products so i can ensure when something is added to the network it gets added to all of the tools and is in our CMDB.

solaradmin

Just leaving DC after attending Splunk .Conf and I will admit I wore my Solarwinds shirts while attending. A few Splunk people asked if I use the app and what we are doing with it and I told them my hopes of maybe using it for performance data but now that Splunk v7 has the ability to collect and display performance data I am not sure what I will use it for.

bobmarley

I would have like to go to the conference but it was in DC..... yuck! I still think I will eventually make use of the app for porting alerts over to Splunk

solaradmin

You don't like DC? I thought it was cool. I guess it was even better for those who brought family as they could go to museums and stuff during the conference. I live in a small northern WI town so anytime I get to a big city I like it.

Got to see what others were doing with Splunk and that was great. Hopefully if the SWUGs turns out to be a big enough success maybe one day Solarwinds will have a conference I like Ignite and VMWorld but those conferences sometimes have a feeling of a sales seminar.

hoppingubu

I haven't even created a dashboard for it. I hope to soon. I am particularly interested in alerts and inventory. I just haven't had the time to do it.

I have searched SolarWinds and know that at least Splunk is getting data and indexing it. Maybe one day I'll be able to work on it.

solaradmin

I'd be interested in keeping up with what you or others are doing with it. I'll do the same

deanmooqe

Hi, I already follow this guideline but there are no output from my searching...could you share what the setup needed for account tab on configuration since I worried wrongly setting?

it is credential for Solarwinds server(I used windows server 2012) or else?

ecklerwr1

This might be a way to do long term trending using splunk as a data warehouse... something I think Jfrazier has been asking for for a long time from SolarWinds. Perhaps this is why SolarWinds made the new Log Manager module?

hoppingubu

Cool dashboard for Splunk. I know my indexer ingests the data from Solarwinds, but I just never got around to creating a dash board... too busy with my other jobs. If you could share it I would greatly appreciate it to see how I can integrate it.

Thanks,

hoppingubu

My thoughts exactly.

bobmarley

It's been quite awhile since I installed the connector in the lab. I have been using Solarwinds and Splunk together but in the opposite direction. I'm ingesting all of my Syslog, SNMPTraps, and Email into Splunk then sending info to Solarwinds when needed.

deverts

bobmarley,

Very interested in what you are doing here! I'm in a new environment (new job) and I've only used NPM syslog before. Here, we have Splunk and the security team wants all logs going to Splunk. Instead of sending to 2 syslog servers, I'd be very interested to know more about what you are forwarding along to NPM. If I can make a more effective, efficient mousetrap...I'm all ears; pun intended.

bobmarley

Guys,

We ended up using Splunk as our single pane of glass and have it it receiving messages from Orion, so essentially reversed roles with it. Orion was missing some key elements in the alert console such as the ability to acknowledge a message and run an action such as an external program that created a trouble ticket. (I wish Orion or Kiwi would have supported this)

I ended up skipping using the Splunk App altogether for this reason. We have a lot of third party tools that tie into Splunk as our central message repository. Due to the different products following different upgrade paths and some products being outside of my teams immediate control we decided to use generic messaging such as Syslog, SNMPTRAP, or Email to receive alert messages into Splunk. We found Email especially useful because some of our monitoring is done out in the cloud, outside of our network and receiving email through our firewalls is way easier than poking a lot of holes in them to support other methods.

Out workflow for a message goes something like this

Orion - Node Down --> Splunk Console --> NOC Operator - person reviews, looks for change tickets or duplicates -->person clicks on button for a ticket -->Ticketing System

solaradmin

thanks for sharing this. These real world examples are my favorite. I am no longer in an environment with Splunk but others will benefit for sure.

bobmarley

The app is pulling in from the Events table, what I needed was the Alerts table. Added the query below to grab the correct table to pull triggered alerts in.

SELECT TriggeredDateTime, TriggeredMessage, Acknowledged, AcknowledgedBy, AcknowledgedDateTime

FROM Orion.AlertActive

MadisonHopm

Hey there!

I use your dashboard with some pretty generic stats that is very good. i appreciate it for this apk.