Using Harvest but send to Splunk

[ChannelTapeFibre]

I'm playing around with integrating Netapp performance logs with Splunk. There's a Splunk Add-on for Netapp, but the development seems to have slowed down and support stops at Ontap 9.4.

I tried the add-on, it works, but I felt it was a bit clunky and not entirely accurate.

An old Splunk blog indicates Splunk will quite happily ingest Graphite formed log lines.

How feasible would it be to configure Harvest, but instead just perhaps log to a file which I can then forward to a Splunk indexer. Maybe even configure Harvest to send to Splunk directly?

[vachagan_gratian]

Hi ChannelTapeFibre,

With Harvest 1.6 that would be hard to achieve. But if you wait for Harvest 2.0, we will have a new architecture supporting multiple exporters. I am not familiar with Splunk, but if you know Python, I think you should be able to write your own exporters. Otherwise I'll try to help 🙂

[ChannelTapeFibre]

I actually kind of got it working. Splunk will ingest most log files and with an additional so called Add-On, it will ingest graphite formatted logs. I was able to configure my Harvest box to send performance metrics to Splunk. It's not pretty, but I may be able to make some use of it.

For my next challenge, I wanted to take the ready made NABox virtual appliance to get all the goodness of a polished package which my customers like, and try to siphon off an additional log stream to Splunk.

Accordning to the Harvest documentation, this is possible using "Graphite relay".

I'm reading the Carbon documentation link , it it speaks of a releay-rules.conf. Seems easy enough, but the same page mentions the main carbon.conf file, which also should be located in /opt/graphite/conf. There's no carbon.conf file in my NABox. Am I missing something here? NABox is working fine as far as I can tell.