Splunk Integration Question...

--===============8755653850685705560==
Content-Type: multipart/alternative; boundary=f46d043c7f563839fc04e5f67e51

--f46d043c7f563839fc04e5f67e51
Content-Type: text/plain; charset=ISO-8859-1

Greetings,
  I was hoping I might find someone who's got the splunk integration
actively working.  I'm running Nagios Core (via EPEL) and Splunk 5.0.3 on
OracleLinux 6.4.

   When I edit cgi.cfg and enable splunk integration, then set the splunk
URL to https://<mysplunkserver>:8000/en-US/app/search/flastimeline, I
notice the nagios URLs look like: https://
<mysplunkserver>:8000/en-US/app/flashtimeline?q=search%20test1.udayton.edu%20<nagios
plugin check>.  I have two questions...

   - Is there a way I can make nagios use the hostname only, not the FQDN?
   We use short names in splunk so we don't a mix of fqdn and short names
   since we use both forwarders and syslog as input.
   - What data is this query looking for, is it expected that I should have
   my nagios log in splunk?  The <nagios plugin check> in the query doesn't
   seem useful to me, unless there's splunk data specifically tied to that
   check, and I'm hoping someone could provide an example.

Kind regards,
-- 
Sean M. Alderman
Senior Engineer, UDit Systems Integration and Engineering
University of Dayton

--f46d043c7f563839fc04e5f67e51
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div>Greetings,<br></div>=A0 I was hoping I migh=
t find someone who&#39;s got the splunk integration actively working.=A0 I&=
#39;m running Nagios Core (via EPEL) and Splunk 5.0.3 on OracleLinux 6.4.<b=
r><br>
</div>=A0=A0 When I edit cgi.cfg and enable splunk integration, then set th=
e splunk URL to https://&lt;mysplunkserver&gt;:8000/en-US/app/search/flasti=
meline, I notice the nagios URLs look like: https://&lt;mysplunkserver&gt;:=
8000/en-US/app/flashtimeline?q=3Dsearch%<a href=3D"http://20test1.udayton.e=
du">20test1.udayton.edu</a>%20&lt;nagios plugin check&gt;.=A0 I have two qu=
estions...<br>
<ul><li>Is there a way I can make nagios use the hostname only, not the FQD=
N?=A0 We use short names in splunk so we don&#39;t a mix of fqdn and short =
names since we use both forwarders and syslog as input.<br></li><li>What da=
ta is this query looking for, is it expected that I should have my nagios l=
og in splunk?=A0 The &lt;nagios plugin check&gt; in the query doesn&#39;t s=
eem useful to me, unless there&#39;s splunk data specifically tied to that =
check, and I&#39;m hoping someone could provide an example.<br clear=3D"all=
">
</li></ul></div><div><div><div><div>Kind regards,<br></div><div>-- <br><div=
 dir=3D"ltr">Sean M. Alderman<br>Senior Engineer, UDit Systems Integration =
and Engineering<br>University of Dayton<br><br></div>
</div></div></div></div></div>

--f46d043c7f563839fc04e5f67e51--


--===============8755653850685705560==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more!
Discover the easy way to master current and previous Microsoft technologies
and advance your career. Get an incredible 1,500+ hours of step-by-step
tutorial videos with LearnDevNow. Subscribe today and save!
http://pubads.g.doubleclick.net/gampad/clk?id=58041391&iu=/4140/ostg.clktrk
--===============8755653850685705560==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Nagios-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null
--===============8755653850685705560==--