Skip to content

Commit cd44b56

Browse files
omrozowicz-splunkomrozowicz-splunk
authored
fix: replace - with _ for metrics (#1213)
* fix: add option to change "-" to an "_" to be compatible with metric schema in Splunk * fix: doc fix and docker-compose change * fix: add docs * chore: pre-commit run * doc: refine * doc: address PR comments, update CHANGELOG
1 parent c3dd6c3 commit cd44b56

File tree

32 files changed

+310
-37
lines changed

32 files changed

+310
-37
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
### Changed
66
- implemented mTLS for Splunk 10
77
- update default microk8s to 1.33
8+
- introduce `splunkMetricNameHyphenToUnderscore` parameter to make metric names follow Splunk schema
89

910
### Fixed
1011

‎charts/splunk-connect-for-snmp/templates/worker/_helpers.tpl‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,8 @@ Common labels
152152
value: {{ .Values.splunk.insecureSSL | default "false" | quote }}
153153
- name: SPLUNK_AGGREGATE_TRAPS_EVENTS
154154
value: {{ .Values.traps.aggregateTrapsEvents | default "false" | quote }}
155+
- name: SPLUNK_METRIC_NAME_HYPHEN_TO_UNDERSCORE
156+
value: {{ .Values.poller.splunkMetricNameHyphenToUnderscore | default "false" | quote }}
155157
- name: SPLUNK_HEC_TOKEN
156158
valueFrom:
157159
secretKeyRef:

‎charts/splunk-connect-for-snmp/values.schema.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -353,6 +353,9 @@
353353
"metricsIndexingEnabled": {
354354
"type": "boolean"
355355
},
356+
"splunkMetricNameHyphenToUnderscore": {
357+
"type": "boolean"
358+
},
356359
"pollBaseProfiles": {
357360
"type": "boolean"
358361
},

‎charts/splunk-connect-for-snmp/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,10 @@ poller:
231231
# https://splunk.github.io/splunk-connect-for-snmp/main/microk8s/configuration/poller-configuration/#append-oid-index-part-to-the-metrics
232232
metricsIndexingEnabled: false
233233

234+
# Replace "-" in a mib name to "_" to make it compatible to Splunk metric schema
235+
# https://help.splunk.com/en/splunk-enterprise/get-data-in/metrics/9.4/introduction-to-metrics/overview-of-metrics
236+
splunkMetricNameHyphenToUnderscore: false
237+
234238
# Enable polling base profiles (with IF-MIB and SNMPv2-MIB) from
235239
# https://github:com/splunk/splunk-connect-for-snmp/blob/main/splunk_connect_for_snmp/profiles/base.yaml
236240
pollBaseProfiles: true

‎docker_compose/.env‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ SPLUNK_HEC_INDEX_EVENTS=netops
3939
SPLUNK_HEC_INDEX_METRICS=netmetrics
4040
SPLUNK_HEC_PATH=/services/collector
4141
SPLUNK_AGGREGATE_TRAPS_EVENTS=false
42+
SPLUNK_METRIC_NAME_HYPHEN_TO_UNDERSCORE=false
4243
IGNORE_EMPTY_VARBINDS=false
4344
SPLUNK_LOG_INDEX=
4445

‎docker_compose/docker-compose.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ x-splunk_extended_setup: &splunk_extended_setup
2222
SPLUNK_HEC_INDEX_EVENTS: ${SPLUNK_HEC_INDEX_EVENTS:-netops}
2323
SPLUNK_HEC_INDEX_METRICS: ${SPLUNK_HEC_INDEX_METRICS:-netmetrics}
2424
SPLUNK_AGGREGATE_TRAPS_EVENTS: ${SPLUNK_AGGREGATE_TRAPS_EVENTS:-false}
25+
SPLUNK_METRIC_NAME_HYPHEN_TO_UNDERSCORE: ${SPLUNK_METRIC_NAME_HYPHEN_TO_UNDERSCORE:-false}
2526

2627
x-workers_general_setup: &workers_general_setup
2728
SC4SNMP_VERSION: ${SC4SNMP_VERSION:-latest}

‎docs/dockercompose/5-traps-configuration.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
Scheduler configuration is stored in the `traps-config.yaml` file. This file has the following sections:
2+
Traps configuration is stored in the `traps-config.yaml` file. This file has the following sections:
33

44
```yaml
55
communities:

‎docs/dockercompose/6-env-file-configuration.md‎

Lines changed: 27 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -45,36 +45,37 @@ Inside the directory with the docker compose files, there is a `.env`. Variables
4545

4646
## Splunk instance
4747

48-
| Variable | Description |
49-
|-------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
50-
| `SPLUNK_HEC_HOST` | IP address or a domain name of a Splunk instance to send data to |
51-
| `SPLUNK_HEC_PROTOCOL` | The protocol of the HEC endpoint: `https` or `http` |
52-
| `SPLUNK_HEC_PORT` | The port of the HEC endpoint |
53-
| `SPLUNK_HEC_TOKEN` | Splunk HTTP Event Collector token |
54-
| `SPLUNK_HEC_INSECURESSL` | Whether to skip checking the certificate of the HEC endpoint when sending data over HTTPS |
55-
| `SPLUNK_SOURCETYPE_TRAPS` | Splunk sourcetype for trap events |
56-
| `SPLUNK_SOURCETYPE_POLLING_EVENTS` | Splunk sourcetype for non-metric polling events |
57-
| `SPLUNK_SOURCETYPE_POLLING_METRICS` | Splunk sourcetype for metric polling events |
58-
| `SPLUNK_HEC_INDEX_EVENTS` | Name of the Splunk event index |
59-
| `SPLUNK_HEC_INDEX_METRICS` | Name of the Splunk metrics index |
60-
| `SPLUNK_HEC_PATH` | Path for the HEC endpoint |
61-
| `SPLUNK_AGGREGATE_TRAPS_EVENTS` | When set to true makes traps events collected as one event inside splunk |
62-
| `IGNORE_EMPTY_VARBINDS` | Details can be found in [empty snmp response message issue](../troubleshooting/polling-issues.md#empty-snmp-response-message-problem) |
63-
| `SPLUNK_LOG_INDEX` | Event index in Splunk where logs from docker containers would be sent |
48+
| Variable | Description |
49+
|-------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
50+
| `SPLUNK_HEC_HOST` | IP address or a domain name of a Splunk instance to send data to |
51+
| `SPLUNK_HEC_PROTOCOL` | The protocol of the HEC endpoint: `https` or `http` |
52+
| `SPLUNK_HEC_PORT` | The port of the HEC endpoint |
53+
| `SPLUNK_HEC_TOKEN` | Splunk HTTP Event Collector token |
54+
| `SPLUNK_HEC_INSECURESSL` | Whether to skip checking the certificate of the HEC endpoint when sending data over HTTPS |
55+
| `SPLUNK_SOURCETYPE_TRAPS` | Splunk sourcetype for trap events |
56+
| `SPLUNK_SOURCETYPE_POLLING_EVENTS` | Splunk sourcetype for non-metric polling events |
57+
| `SPLUNK_SOURCETYPE_POLLING_METRICS` | Splunk sourcetype for metric polling events |
58+
| `SPLUNK_HEC_INDEX_EVENTS` | Name of the Splunk event index |
59+
| `SPLUNK_HEC_INDEX_METRICS` | Name of the Splunk metrics index |
60+
| `SPLUNK_HEC_PATH` | Path for the HEC endpoint |
61+
| `SPLUNK_AGGREGATE_TRAPS_EVENTS` | When set to true makes traps events collected as one event inside splunk |
62+
| `SPLUNK_METRIC_NAME_HYPHEN_TO_UNDERSCORE` | Replaces hyphens with underscores in generated metric names to ensure compatibility with Splunk's metric schema |
63+
| `IGNORE_EMPTY_VARBINDS` | Details can be found in [empty snmp response message issue](../troubleshooting/polling-issues.md#empty-snmp-response-message-problem) |
64+
| `SPLUNK_LOG_INDEX` | Event index in Splunk where logs from docker containers would be sent |
6465

6566
## Workers
6667

6768
### General
68-
| Variable | Description |
69-
|------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
70-
| `WALK_RETRY_MAX_INTERVAL` | Maximum time interval between walk attempts |
71-
| `WALK_MAX_RETRIES` | Maximum number of walk retries |
72-
| `METRICS_INDEXING_ENABLED` | Details can be found in [append oid index part to the metrics](../microk8s/configuration/poller-configuration.md#append-oid-index-part-to-the-metrics) |
73-
| `POLL_BASE_PROFILES` | Enable polling base profiles (with IF-MIB and SNMPv2-MIB) |
74-
| `IGNORE_NOT_INCREASING_OIDS` | Ignoring `occurred: OID not increasing` issues for hosts specified in the array, ex: IGNORE_NOT_INCREASING_OIDS=127.0.0.1:164,127.0.0.6 |
75-
| `WORKER_LOG_LEVEL` | Logging level of the workers, possible options: DEBUG, INFO, WARNING, ERROR, CRITICAL, or FATAL |
76-
| `UDP_CONNECTION_TIMEOUT` | Timeout in seconds for SNMP operations |
77-
| `MAX_OID_TO_PROCESS` | Sometimes SNMP Agent cannot accept more than X OIDs per once, so if the error "TooBig" is visible in logs, decrease the number of MAX_OID_TO_PROCESS |
69+
| Variable | Description |
70+
|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------|
71+
| `WALK_RETRY_MAX_INTERVAL` | Maximum time interval between walk attempts |
72+
| `WALK_MAX_RETRIES` | Maximum number of walk retries |
73+
| `METRICS_INDEXING_ENABLED` | Details can be found in [append oid index part to the metrics](../microk8s/configuration/poller-configuration.md#append-oid-index-part-to-the-metrics) |
74+
| `POLL_BASE_PROFILES` | Enable polling base profiles (with IF-MIB and SNMPv2-MIB) |
75+
| `IGNORE_NOT_INCREASING_OIDS` | Ignoring `occurred: OID not increasing` issues for hosts specified in the array, ex: IGNORE_NOT_INCREASING_OIDS=127.0.0.1:164,127.0.0.6 |
76+
| `WORKER_LOG_LEVEL` | Logging level of the workers, possible options: DEBUG, INFO, WARNING, ERROR, CRITICAL, or FATAL |
77+
| `UDP_CONNECTION_TIMEOUT` | Timeout in seconds for SNMP operations |
78+
| `MAX_OID_TO_PROCESS` | Sometimes SNMP Agent cannot accept more than X OIDs per once, so if the error "TooBig" is visible in logs, decrease the number of MAX_OID_TO_PROCESS |
7879

7980
### Worker Poller
8081
| Variable | Description |

‎docs/microk8s/configuration/poller-configuration.md‎

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,67 @@ out of this object:
9999
}
100100
```
101101
102+
### Replace "-" with "_" in metrics name
103+
104+
There is a known issue with metric names that are not following the Splunk metric schema. Read more at [addressing metric naming](../../troubleshooting/general-issues.md#addressing-metric-naming-conflicts-for-splunk-integration).
105+
To ensure seamless compatibility and avoid potential issues, SC4SNMP provides a configuration option to automatically convert
106+
hyphens in metric names to underscores.
107+
108+
You can enable this conversion by setting the `splunkMetricNameHyphenToUnderscore` parameter to `true` within the `poller` section of your SC4SNMP configuration:
109+
110+
```yaml
111+
poller:
112+
splunkMetricNameHyphenToUnderscore: true
113+
```
114+
115+
Enabling this option transforms metric names from their hyphenated format to an underscore-separated format, aligning them with common Splunk metric naming conventions.
116+
117+
Before conversion (hyphens):
118+
119+
```json
120+
{
121+
"frequency": "60",
122+
"ifAdminStatus": "up",
123+
"ifAlias": "1",
124+
"ifDescr": "GigabitEthernet1",
125+
"ifIndex": "1",
126+
"ifName": "Gi1",
127+
"ifOperStatus": "up",
128+
"ifPhysAddress": "0a:aa:ef:53:67:15",
129+
"ifType": "ethernetCsmacd",
130+
"metric_name:sc4snmp.IF-MIB.ifInDiscards": 0,
131+
"metric_name:sc4snmp.IF-MIB.ifInErrors": 0,
132+
"metric_name:sc4snmp.IF-MIB.ifInOctets": 1481605109,
133+
"metric_name:sc4snmp.IF-MIB.ifOutDiscards": 0,
134+
"metric_name:sc4snmp.IF-MIB.ifOutErrors": 0,
135+
"metric_name:sc4snmp.IF-MIB.ifOutOctets": 3942570709,
136+
"profiles": "TEST"
137+
}
138+
```
139+
140+
After conversion (underscores):
141+
142+
```json
143+
{
144+
"frequency": "60",
145+
"ifAdminStatus": "up",
146+
"ifAlias": "1",
147+
"ifDescr": "GigabitEthernet1",
148+
"ifIndex": "1",
149+
"ifName": "Gi1",
150+
"ifOperStatus": "up",
151+
"ifPhysAddress": "0a:aa:ef:53:67:15",
152+
"ifType": "ethernetCsmacd",
153+
"metric_name:sc4snmp.IF_MIB.ifInDiscards": 0,
154+
"metric_name:sc4snmp.IF_MIB.ifInErrors": 0,
155+
"metric_name:sc4snmp.IF_MIB.ifInOctets": 1481605109,
156+
"metric_name:sc4snmp.IF_MIB.ifOutDiscards": 0,
157+
"metric_name:sc4snmp.IF_MIB.ifOutErrors": 0,
158+
"metric_name:sc4snmp.IF_MIB.ifOutOctets": 3942570709,
159+
"profiles": "TEST"
160+
}
161+
```
162+
102163
### Disable automatic polling of base profiles
103164

104165
There are [two profiles](https://github.com/splunk/splunk-connect-for-snmp/blob/main/splunk_connect_for_snmp/profiles/base.yaml) that are being polled by default, so that even without any configuration set up, you can see
@@ -109,7 +170,6 @@ poller:
109170
pollBaseProfiles: false
110171
```
111172
112-
113173
### Configure inventory
114174
To update inventory, see [Update Inventory and Profile](#update-inventory).
115175

‎docs/microk8s/configuration/values-params-description.md‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -92,14 +92,15 @@ Detailed documentation about configuring:
9292

9393
Detailed documentation about configuring poller can be found in [Poller](poller-configuration.md).
9494

95-
| Variable | Description | Default |
96-
|--------------------------|---------------------------------------------------------------|---------|
97-
| `metricsIndexingEnabled` | Appends OID indexes to metrics | `false` |
98-
| `pollBaseProfiles` | Enables polling base profiles | `true` |
99-
| `maxOidToProcess` | Maximum number of OIDs requested from SNMP Agent at once | `70` |
100-
| `usernameSecrets` | List of kubernetes secrets name that will be used for polling | |
101-
| `inventory` | List of configuration for polling | |
102-
| `logLevel` | Log level for a poller pod | `INFO` |
95+
| Variable | Description | Default |
96+
|--------------------------------------|-----------------------------------------------------------------------------------------------------------------|---------|
97+
| `metricsIndexingEnabled` | Appends OID indexes to metrics | `false` |
98+
| `splunkMetricNameHyphenToUnderscore` | Replaces hyphens with underscores in generated metric names to ensure compatibility with Splunk's metric schema | `false` |
99+
| `pollBaseProfiles` | Enables polling base profiles | `true` |
100+
| `maxOidToProcess` | Maximum number of OIDs requested from SNMP Agent at once | `70` |
101+
| `usernameSecrets` | List of kubernetes secrets name that will be used for polling | |
102+
| `inventory` | List of configuration for polling | |
103+
| `logLevel` | Log level for a poller pod | `INFO` |
103104

104105
## Worker
105106

0 commit comments

Comments
 (0)