Skip to content

Source types for the Splunk Add-on for Linux

The Splunk Add-on for Linux provides the index-time and search-time knowledge for CollectD and AuditD.

  • linux:collectd:http:json is for performance metrics sent to the Splunk platform through HEC in JSON format
  • linux:collectd:graphite is for performance metrics sent to the Splunk platform through TCP in Graphite format
  • linux:collectd:http:metrics is for performance metrics sent to the Splunk platform through HEC.

CollectD data works with ITSI data models.

Source type Event type ITSI data modules
linux:collectd:http:json

or

linux:collectd:graphite		 linux_collectd_cpu Operating System Module data model reference table
linux_collectd_memory Operating System Module data model reference table
linux_collectd_swap Operating System Module data model reference table
linux_collectd_df Operating System Module data model reference table
linux_collectd_interface Operating System Module data model reference table
linux_collectd_disk Operating System Module data model reference table
linux_collectd_load Operating System Module data model reference table
linux_collectd_processes Operating System Module data model reference table
linux_collectd_protocols Operating System Module data model reference table
linux_collectd_irq Operating System Module data model reference table
linux_collectd_tcpconns Operating System Module data model reference table
linux_collectd_thermal Operating System Module data model reference table
linux_collectd_uptime Operating System Module data model reference table

Note

The two source types linux:collectd:http:json and linux:collectd:graphite collect the same data from CollectD. However, the collection method and the data format are different for these two source types.

Send data in JSON format through HEC. The data collected in JSON format contains more information than Graphite provides. Using JSON through HEC improves knowledge mapping to the Splunk IT Service Intelligence (ITSI) data model for Linux KPIs. For example, a network interface measurement in Graphite format is presented as two strings:

  • localhost-234.interface-eno16777984.if_octets.tx 573.300503  1481692948
  • localhost-234.interface-eno16777984.if_octets.rx 783.017354 1481692948

The same measurement in JSON format is presented as a single event:

{"values":[783.017354110699,573.300503324745],"dstypes":["derive","derive"],"dsnames":["rx","tx"],"time":14816 92948.296,"interval":60.000,"host":"localhost-234","plugin":"interface","plugin_instance":"eno16777984","type":"if _octets","type_instance":"","meta":{"network:received":true}}

AuditD data works with CIM data models.

Source type Event type CIM data modules
linux:audit linux_audit_account_change Change
linux:audit linux_audit_authentication Authentication
linux:audit linux_audit_endpoint Endpoint
linux:audit linux_audit_endpoint_services Endpoint