[collectd] output plugin for Splunk

[Clay Loveless]

On Aug 20, 2008, at 12:18 AM, Florian Forster wrote:

> I'm afraid this is the first time I've heard about it. I love the name
> and the company's motto (``Take the sh out of IT''), though :)

Yeah, Splunk is nice. I recommend it to anyone looking for a bucket to  
house IT data of various types, such as that which comes from  
collectd. :)

[snip]

> Other that that I'm afraid I'm totally clueless.. Hope this helps,
> though..


That did help, thank you. I have ultimately decided to go with a  
combination of Splunk's "scripted input" feature and collectd's  
unixsock interface. With that combination, Splunk will run the script  
of my choosing on a configurable interval and index that script's  
STDOUT.

I've written a Python interface to collectd's socket interface, which  
is here at the moment:

http://s3.killersoft.com/collect.py

I would really like feedback on the approach I'm using here. It's  
pretty bare bones -- specifically, I'm interested in my use of the  
FLUSH command. I notice that the network.c file in the collectd core  
keeps track of data that's already been sent to avoid sending it  
again. Will using FLUSH in this way achieve the same effect? (Doesn't  
seem like it will.)

Thanks,
Clay

--
Clay Loveless
Co-founder & Chief Architect
Mashery
clay at mashery.com