Splunk Integration Question...

[Sean Alderman]

Greetings,
  I was hoping I might find someone who's got the splunk integration
actively working.  I'm running Nagios Core (via EPEL) and Splunk 5.0.3 on
OracleLinux 6.4.

   When I edit cgi.cfg and enable splunk integration, then set the splunk
URL to https://<mysplunkserver>:8000/en-US/app/search/flastimeline, I
notice the nagios URLs look like: https://
<mysplunkserver>:8000/en-US/app/flashtimeline?q=search%20test1.udayton.edu%20<nagios
plugin check>.  I have two questions...

   - Is there a way I can make nagios use the hostname only, not the FQDN?
   We use short names in splunk so we don't a mix of fqdn and short names
   since we use both forwarders and syslog as input.
   - What data is this query looking for, is it expected that I should have
   my nagios log in splunk?  The <nagios plugin check> in the query doesn't
   seem useful to me, unless there's splunk data specifically tied to that
   check, and I'm hoping someone could provide an example.

Kind regards,
-- 
Sean M. Alderman
Senior Engineer, UDit Systems Integration and Engineering
University of Dayton
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.monitoring-lists.org/archive/users/attachments/20130909/f0223a23/attachment.html>
-------------- next part --------------
------------------------------------------------------------------------------
Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more!
Discover the easy way to master current and previous Microsoft technologies
and advance your career. Get an incredible 1,500+ hours of step-by-step
tutorial videos with LearnDevNow. Subscribe today and save!
http://pubads.g.doubleclick.net/gampad/clk?id=58041391&iu=/4140/ostg.clktrk
-------------- next part --------------
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null