Contents

• About
• Requirements
• Splunk Configuration
• Deploy the IT Squared Cloud-Native Integration for Riverbed APM
• Next Steps

About

Data from Riverbed AppInternals can be ingested into Splunk with the help of the IT Squared Cloud-Native Integration for Riverbed APM.  You can ingest AppInternals Application/ Transaction/ Instance/ Server/ Server Tag metrics and delays into Splunk defining what is being ingested with the YAML configuration file. Users can analyze the data using the dashboards in the IT Squared Splunk App for Aternity and Riverbed or by creating their own visualizations.

Requirements

Splunk Enterprise 7.0 or later

Splunk Configuration

Configuration steps for Splunk:

1. Create/choose index to store ingested data, add it to the list of indexes searched by default.
   
2. The IT Squared / Cloud-Native Integration for Riverbed APM sends data to Splunk using HTTP Event Collector (HEC). By default, Splunk does not enable HEC, follow HTTP Event Collector walkthrough to enable and create HEC endpoint pointing to the index from step 1.
   
3. Check whether HEC is accessible from where the IT Squared / Cloud-Native Integration for Riverbed APM would be running, for example with the following curl command:
   curl -k  http://HeavyForwarder_host:8088/services/collector/event”  -H “Authorization: Splunk HEC_Token” -d ‘{“event”: “hello world”, “host”: “Test”}’
   Expected result:
   {“text”:”Success”,”code”:0}
4. Check whether Splunk REST API is accessible from where the IT Squared / Cloud-Native Integration for Riverbed APM would be running, For Splunk Cloud you might need to enable it first via support ticket, see https://docs.splunk.com/Documentation/Splunk/7.3.0/RESTTUT/RESTandCloud
   curl -ku username:password https://SearchHead_host:8089/servicesNS/admin/search/search/jobs/export -d search=”search index=index_created_on_step_1 | head 1″
   Expected result – xml with 1 event (most likely your “hello world”), like:

Deploy the IT Sguared Cloud-Native for Riverbed APM

Once Splunk is configured follow the IT Squared / Cloud-Native Integration for Riverbed APM documentation to deploy it and set up data ingestion into Splunk.

Next Steps

After deployment is completed data starts flowing into the configured index. It is recommended to install the Splunk App for Aternity and Riverbed.

The Splunk App for Aternity and Riverbed adds dashboards for analytics and visualizations of ingested data, drilldowns into AppInternals with time frames and filters already set, prebuilt panels for the user’s dashboards and data normalization and enrichment for out of the box integration with Splunk ITSI Module for Application Performance Monitoring.