Thursday, April 10, 2008

Search your data with Splunk

While I was gathering information about plugins for Nagios, I found out about splunk. Put in short splunk will accept any data you put into it and you'll be able to isearch and report on the data. Splunk does provide a way to customize how it index your data. As an example I took the os-monitoring bundle available on the splunkbase.com website, what it does is feed output from vmstat,lsof,netstat and other commands into splunk at that point you can search for system status data and generate reports (the bundle is shipped with several reports alredy created).

Splunk comes in a free and commercial version. The diffrences can be found here, shortly the commercial version has some interesting features like access control and distributed indexing.
One possible probelm of the free version is that it's limited to index 500Mb of data a day.

No comments: