New component: Splunk Enterprise Receiver

[MovieStoreGuy]

The purpose and use-cases of the new component

For those using self host splunk (Splunk Enterprise), there is a few endpoints being exposed by the indexer cluster that can be captured and help monitor the platform.

Example configuration for the component

splunkenterprise:
  hostname: <host url>
  collection_period: <time>
  metrics:
    splunk.enterprise.cluster.peer.status:
       enabled: true
    # ... I am sure there is more but we'll save it for more feedback from the splunk crew

Telemetry data types supported

Metrics

Is this a vendor-specific component? If so, are you proposing to contribute this as a representative of the vendor?

This is a vendor specific component but I am happy for this component to be a community support receiver

Sponsor (Optional)

It would be nice to have someone from Splunk @dmitryax , @bogdandrutu as a sponsor for this.

[dmitryax]

I don't work on Splunk Enterprise, but I can sponsor this receiver

[MovieStoreGuy]

Thank you @dmitryax.

We have a few custom checks that existing with the SignalFx agent, however, I don't believe what we are doing is unique to just Atlassian so I am happy to upstream our work.

[dmitryax]

We have a few custom checks that existing with the SignalFx agent

What do you mean? Is there a Signalfx agent monitor for Spunk Enterprise?

[MovieStoreGuy]

As in we've written a custom python monitor that currently monitors are hosted splunk platform using exposed rest endpoints that are published.

(Sorry, still trying to wake up)

[dmitryax]

Oh I see. Makes sense. It would be nice to have a native OTel collector receiver for that

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

[atoulme]

I'd be interested to see this one happen. How can I help?

[MovieStoreGuy]

Hey @atoulme ,

Sorry, I've been meaning to come back to this one. What I wanted to do is take the existing internal python scripts we use to monitor splunk and upstream it for everyone to use. We are currently using Splunk 8 and looking forward to Splunk 9.

What would be really helpful is any external documentation on monitor endpoints, associated runbooks, and potentially help validating if this could work with other deployments of Splunk would be amazing.

[atoulme]

Ah, I'm not sure I have a comprehensive guide. I'm always in favor of small iterations for this type of things - we can start with just one or two metrics. Splunk publishes an introspection API we can call: https://docs.splunk.com/Documentation/Splunk/9.0.1/RESTREF/RESTintrospect#server.2Fhealth.2Fdeployment

Starting small with just one call.

[MovieStoreGuy]

If you're happy to wait the weekend, my goal this week was to port our internal stuff to the collector to then share upstream.

Also happy to talk more on slack