gNMI 和 Splunk 集成

强大的性能和简单的集成,由 InfluxData 构建的开源数据连接器 Telegraf 提供支持。

info

这不是大规模实时查询的推荐配置。为了进行查询和压缩优化、高速摄取和高可用性,您可能需要考虑 gNMI 和 InfluxDB

50 亿+

Telegraf 下载量

#1

时序数据库
来源:DB Engines

10 亿+

InfluxDB 下载量

2,800+

贡献者

目录

强大的性能,无限的扩展能力

收集、组织和处理海量高速数据。当您将任何数据视为时序数据时,它都更有价值。InfluxDB 是排名第一的时序平台,旨在与 Telegraf 一起扩展。

查看入门方法

输入和输出集成概述

gNMI (gRPC 网络管理接口) 输入插件使用 gNMI Subscribe 方法从网络设备收集遥测数据。它支持 TLS 以实现安全身份验证和数据传输。

此输出插件有助于将 Telegraf 收集的指标直接流式传输到 Splunk,通过 HTTP Event Collector 实现与 Splunk 强大的分析平台的轻松集成。

集成详情

gNMI

此输入插件与供应商无关,可与任何支持 gNMI 规范的平台一起使用。它基于 gNMI Subscribe 方法使用遥测数据,从而可以实时监控网络设备。

Splunk

使用 Telegraf 轻松地从许多不同的来源收集和聚合指标,并将它们发送到 Splunk。此配置利用 HTTP 输出插件和专门的 Splunk 指标序列化器,确保将数据高效地摄取到 Splunk 的指标索引中。HEC 是 Splunk 提供的一种高级机制,旨在通过 HTTP 或 HTTPS 可靠地大规模收集数据,为安全性、监控和分析工作负载提供关键功能。Telegraf 与 Splunk HEC 的集成通过利用标准 HTTP 协议、内置身份验证和结构化数据序列化来简化操作,优化指标摄取并实现即时可操作的见解。

配置

gNMI


[[inputs.gnmi]]
  ## Address and port of the gNMI GRPC server
  addresses = ["10.49.234.114:57777"]

  ## define credentials
  username = "cisco"
  password = "cisco"

  ## gNMI encoding requested (one of: "proto", "json", "json_ietf", "bytes")
  # encoding = "proto"

  ## redial in case of failures after
  # redial = "10s"

  ## gRPC Keepalive settings
  ## See https://pkg.go.dev/google.golang.org/grpc/keepalive
  ## The client will ping the server to see if the transport is still alive if it has
  ## not see any activity for the given time.
  ## If not set, none of the keep-alive setting (including those below) will be applied.
  ## If set and set below 10 seconds, the gRPC library will apply a minimum value of 10s will be used instead.
  # keepalive_time = ""

  ## Timeout for seeing any activity after the keep-alive probe was
  ## sent. If no activity is seen the connection is closed.
  # keepalive_timeout = ""

  ## gRPC Maximum Message Size
  # max_msg_size = "4MB"

  ## Enable to get the canonical path as field-name
  # canonical_field_names = false

  ## Remove leading slashes and dots in field-name
  # trim_field_names = false

  ## Guess the path-tag if an update does not contain a prefix-path
  ## Supported values are
  ##   none         -- do not add a 'path' tag
  ##   common path  -- use the common path elements of all fields in an update
  ##   subscription -- use the subscription path
  # path_guessing_strategy = "none"

  ## Prefix tags from path keys with the path element
  # prefix_tag_key_with_path = false

  ## Optional client-side TLS to authenticate the device
  ## Set to true/false to enforce TLS being enabled/disabled. If not set,
  ## enable TLS only if any of the other options are specified.
  # tls_enable =
  ## Trusted root certificates for server
  # tls_ca = "/path/to/cafile"
  ## Used for TLS client certificate authentication
  # tls_cert = "/path/to/certfile"
  ## Used for TLS client certificate authentication
  # tls_key = "/path/to/keyfile"
  ## Password for the key file if it is encrypted
  # tls_key_pwd = ""
  ## Send the specified TLS server name via SNI
  # tls_server_name = "kubernetes.example.com"
  ## Minimal TLS version to accept by the client
  # tls_min_version = "TLS12"
  ## List of ciphers to accept, by default all secure ciphers will be accepted
  ## See https://pkg.go.dev/crypto/tls#pkg-constants for supported values.
  ## Use "all", "secure" and "insecure" to add all support ciphers, secure
  ## suites or insecure suites respectively.
  # tls_cipher_suites = ["secure"]
  ## Renegotiation method, "never", "once" or "freely"
  # tls_renegotiation_method = "never"
  ## Use TLS but skip chain & host verification
  # insecure_skip_verify = false

  ## gNMI subscription prefix (optional, can usually be left empty)
  ## See: https://github.com/openconfig/reference/blob/master/rpc/gnmi/gnmi-specification.md#222-paths
  # origin = ""
  # prefix = ""
  # target = ""

  ## Vendor specific options
  ## This defines what vendor specific options to load.
  ## * Juniper Header Extension (juniper_header): some sensors are directly managed by
  ##   Linecard, which adds the Juniper GNMI Header Extension. Enabling this
  ##   allows the decoding of the Extension header if present. Currently this knob
  ##   adds component, component_id & sub_component_id as additional tags
  # vendor_specific = []

  ## YANG model paths for decoding IETF JSON payloads
  ## Model files are loaded recursively from the given directories. Disabled if
  ## no models are specified.
  # yang_model_paths = []

  ## Define additional aliases to map encoding paths to measurement names
  # [inputs.gnmi.aliases]
  #   ifcounters = "openconfig:/interfaces/interface/state/counters"

  [[inputs.gnmi.subscription]]
    ## Name of the measurement that will be emitted
    name = "ifcounters"

    ## Origin and path of the subscription
    ## See: https://github.com/openconfig/reference/blob/master/rpc/gnmi/gnmi-specification.md#222-paths
    ##
    ## origin usually refers to a (YANG) data model implemented by the device
    ## and path to a specific substructure inside it that should be subscribed
    ## to (similar to an XPath). YANG models can be found e.g. here:
    ## https://github.com/YangModels/yang/tree/master/vendor/cisco/xr
    origin = "openconfig-interfaces"
    path = "/interfaces/interface/state/counters"

    ## Subscription mode ("target_defined", "sample", "on_change") and interval
    subscription_mode = "sample"
    sample_interval = "10s"

    ## Suppress redundant transmissions when measured values are unchanged
    # suppress_redundant = false

    ## If suppression is enabled, send updates at least every X seconds anyway
    # heartbeat_interval = "60s"

Splunk

[[outputs.http]]
  ## Splunk HTTP Event Collector endpoint
  url = "https://splunk.example.com:8088/services/collector"

  ## HTTP method to use
  method = "POST"

  ## Splunk authentication token
  headers = {"Authorization" = "Splunk YOUR_SPLUNK_HEC_TOKEN"}

  ## Serializer for formatting metrics specifically for Splunk
  data_format = "splunkmetric"

  ## Optional parameters
  # timeout = "5s"
  # insecure_skip_verify = false
  # tls_ca = "/path/to/ca.pem"
  # tls_cert = "/path/to/cert.pem"
  # tls_key = "/path/to/key.pem"

输入和输出集成示例

gNMI

  1. 监控 Cisco 设备:使用 gNMI 插件从 Cisco IOS XR、NX-OS 或 IOS XE 设备收集遥测数据以进行性能监控。

  2. 实时网络洞察:借助 gNMI 插件,网络管理员可以深入了解实时指标,例如接口统计信息和 CPU 使用率。

  3. 安全数据采集:配置具有 TLS 设置的 gNMI 插件,以确保在从设备收集敏感遥测数据时进行安全通信。

  4. 灵活的数据处理:使用订阅选项自定义您想要根据特定需求或要求收集的遥测数据。

  5. 错误处理:该插件包括故障排除选项,用于处理常见问题,例如缺少指标名称或 TLS 握手失败。

Splunk

  1. 实时安全分析:利用此插件将来自各种应用程序的安全相关指标实时流式传输到 Splunk 中。组织可以通过关联跨系统的数据流立即检测到威胁,从而显着缩短检测和响应时间。

  2. 多云基础设施监控:集成 Telegraf 以将来自多云环境的指标直接整合到 Splunk 中,从而实现全面的可见性和运营情报。这种统一的监控使团队能够快速检测性能问题并简化云资源管理。

  3. 动态容量规划:部署该插件以将来自容器编排平台(如 Kubernetes)的资源指标持续推送到 Splunk 中。利用 Splunk 的分析功能,团队可以自动化预测性扩展和资源分配,避免资源瓶颈并最大限度地降低成本。

  4. 自动化事件响应工作流程:将此插件与 Splunk 的警报系统结合使用,以创建自动化事件响应工作流程。Telegraf 收集的指标会触发实时警报和自动化修复脚本,确保快速解决问题并保持高系统可用性。

反馈

感谢您成为我们社区的一份子!如果您有任何一般性反馈或在这些页面上发现任何错误,我们欢迎并鼓励您提出意见。请在 InfluxDB 社区 Slack 中提交您的反馈。

强大的性能,无限的扩展能力

收集、组织和处理海量高速数据。当您将任何数据视为时序数据时,它都更有价值。InfluxDB 是排名第一的时序平台,旨在与 Telegraf 一起扩展。

查看入门方法

相关集成

HTTP 和 InfluxDB 集成

HTTP 插件从一个或多个 HTTP(S) 端点收集指标。它支持各种身份验证方法和数据格式的配置选项。

查看集成

Kafka 和 InfluxDB 集成

此插件从 Kafka 读取消息,并允许基于这些消息创建指标。它支持各种配置,包括不同的 Kafka 设置和消息处理选项。

查看集成

Kinesis 和 InfluxDB 集成

Kinesis 插件允许从 AWS Kinesis 流中读取指标。它支持多种输入数据格式,并提供带有 DynamoDB 的检查点功能,以实现可靠的消息处理。

查看集成