> ## Documentation Index > Fetch the complete documentation index at: https://otel.fyi/llms.txt > Use this file to discover all available pages before exploring further. # Splunkenterprise > OpenTelemetry receiver for Splunkenterprise # Splunkenterprise Receiver ![Status](https://img.shields.io/badge/status-alpha-red) **Available in:** `contrib` **Maintainers:** [@shalper2](https://github.com/shalper2), [@MovieStoreGuy](https://github.com/MovieStoreGuy), [@greatestusername](https://github.com/greatestusername) **Source:** [opentelemetry-collector-contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/splunkenterprisereceiver) ## Supported Telemetry ![Metrics](https://img.shields.io/badge/metrics-alpha-green) ## Overview ## Configuration **By default the Splunk Enterprise receiver is not configured to gather any metrics other than `splunk.health`** The following settings are required, omitting them will either cause your receiver to fail to compile or result in 4/5xx return codes during scraping. **NOTE:** These must be set for each Splunk instance type (indexer, search head, or cluster master) from which you wish to pull metrics. At present, only one of each type is accepted, per configured receiver instance. This means, for example, that if you have three different "indexer" type instances that you would like to pull metrics from you will need to configure three different `splunkenterprise` receivers for each indexer node you wish to monitor. * `basicauth` (from [basicauthextension](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/extension/basicauthextension)): A configured stanza for the basicauthextension. * `auth` (no default): String name referencing your auth extension. * `endpoint` (no default): your Splunk Enterprise host's endpoint. The following settings are optional: * `collection_interval` (default: 10m): The time between scrape attempts. * `timeout` (default: 60s): The time the scrape function will wait for a response before returning empty. * `build_version_info` (default: false): Elect to run an additional scrape which will retrieve build and version info for the configured endpoints and attach this as attributes to the selected metrics. A value of false will report an empty string as the attribute value but will speed up the receiver slightly. > **Note:** The receiver type has been renamed from `splunkenterprise` to `splunk_enterprise`. The old name is still accepted but will log a deprecation warning. ## Basic Example: ```yaml theme={null} extensions: basicauth/indexer: client_auth: username: admin password: securityFirst basicauth/cluster_master: client_auth: username: admin password: securityFirst receivers: splunk_enterprise: indexer: auth: authenticator: basicauth/indexer endpoint: "https://localhost:8089" timeout: 45s cluster_master: auth: authenticator: basicauth/cluster_master endpoint: "https://localhost:8089" timeout: 45s exporters: debug: verbosity: basic service: extensions: [basicauth/indexer, basicauth/cluster_master] pipelines: metrics: receivers: [splunkenterprise] exporters: [debug] ``` ### Individual Cluster Config Example (with specific metrics enabled/disabled): ```yaml theme={null} extensions: basicauth/indexer: client_auth: username: admin_user password: XXXXXXXXX basicauth/cluster_master: client_auth: username: admin_user password: XXXXXXXXX basicauth/search_head: client_auth: username: admin_user password: XXXXXXXXX basicauth/monitoring_console: client_auth: username: admin_user password: XXXXXXXXX receivers: splunkenterprise/indexer: indexer: auth: authenticator: basicauth/indexer endpoint: "https://ip.ip.ip.ip:8089" tls: insecure_skip_verify: true metrics: splunk.indexer.throughput: enabled: true splunk.data.indexes.extended.total.size: enabled: true splunk.data.indexes.extended.event.count: enabled: true splunk.data.indexes.extended.raw.size: enabled: true splunk.data.indexes.extended.bucket.event.count: enabled: true splunk.data.indexes.extended.bucket.count: enabled: true splunk.data.indexes.extended.bucket.hot.count: enabled: true splunk.data.indexes.extended.bucket.warm.count: enabled: true splunk.server.introspection.queues.current: enabled: true splunk.server.introspection.queues.current.bytes: enabled: true splunk.health: enabled: false splunkenterprise/cluster_master: cluster_master: auth: authenticator: basicauth/cluster_master endpoint: "https://ip.ip.ip.ip:8089" tls: insecure_skip_verify: true metrics: splunk.parse.queue.ratio: enabled: true splunk.indexer.avg.rate: enabled: true splunk.pipeline.set.count: enabled: true splunk.aggregation.queue.ratio: enabled: true splunk.typing.queue.ratio: enabled: true splunk.indexer.queue.ratio: enabled: true splunk.indexes.bucket.count: enabled: true splunk.indexes.size: enabled: true splunk.indexer.raw.write.time: enabled: true splunk.indexer.cpu.time: enabled: true splunk.indexes.avg.size: enabled: true splunk.indexes.avg.usage: enabled: true splunk.indexes.median.data.age: enabled: true splunk.scheduler.avg.execution.latency: enabled: true splunk.scheduler.completion.ratio: enabled: true splunk.scheduler.avg.run.time: enabled: true splunk.buckets.searchable.status: enabled: true splunk.health: enabled: true splunkenterprise/monitoring_console: cluster_master: auth: authenticator: basicauth/monitoring_console endpoint: "https://ip.ip.ip.ip:8089" tls: insecure_skip_verify: true metrics: splunk.parse.queue.ratio: enabled: true splunk.indexer.avg.rate: enabled: true splunk.pipeline.set.count: enabled: true splunk.aggregation.queue.ratio: enabled: true splunk.typing.queue.ratio: enabled: true splunk.indexer.queue.ratio: enabled: true splunk.indexes.bucket.count: enabled: true splunk.indexes.size: enabled: true splunk.indexer.raw.write.time: enabled: true splunk.indexer.cpu.time: enabled: true splunk.indexes.avg.size: enabled: true splunk.indexes.avg.usage: enabled: true splunk.indexes.median.data.age: enabled: true splunk.scheduler.avg.execution.latency: enabled: true splunk.scheduler.completion.ratio: enabled: true splunk.scheduler.avg.run.time: enabled: true splunk.buckets.searchable.status: enabled: true splunk.health: enabled: true splunkenterprise/search_head: search_head: auth: authenticator: basicauth/search_head endpoint: "https://ip.ip.ip.ip:8089" tls: insecure_skip_verify: true metrics: splunk.server.searchartifacts.adhoc: enabled: true splunk.server.searchartifacts.scheduled: enabled: true splunk.server.searchartifacts.completed: enabled: true splunk.server.searchartifacts.incomplete: enabled: true splunk.server.searchartifacts.invalid: enabled: true splunk.server.searchartifacts.savedsearches: enabled: true splunk.server.searchartifacts.job.cache.size: enabled: true splunk.server.searchartifacts.job.cache.count: enabled: true splunk.server.searchartifacts.adhoc.size: enabled: true splunk.server.searchartifacts.scheduled.size: enabled: true splunk.server.searchartifacts.completed.size: enabled: true splunk.server.searchartifacts.incomplete.size: enabled: true splunk.search.duration: enabled: true splunk.search.initiation: enabled: true splunk.search.status: enabled: true splunk.search.success: enabled: true splunk.kvstore.status: enabled: true splunk.kvstore.replication.status: enabled: true splunk.kvstore.backup.status: enabled: true splunk.health: enabled: false service: extensions: [basicauth/indexer, basicauth/cluster_master, basicauth/monitoring_console, basicauth/search_head] pipelines: metrics: receivers: [splunkenterprise/indexer, splunkenterprise/cluster_master, splunkenterprise/monitoring_console, splunkenterprise/search_head] exporters: [otlp_grpc] ``` ## Custom SPL Searches The receiver supports running arbitrary SPL searches against configured Splunk endpoints. This allows you to create custom metrics from any data available in your Splunk deployment. **WARNING:** Custom searches execute ad-hoc searches on your Splunk deployment. Be mindful of the performance impact, especially with complex searches or short collection intervals. ### Search Configuration Each custom search requires: * `spl` (required): The SPL search string. Can be provided as a single line or multi-line YAML block. * `target` (required): The endpoint type to run the search against. Must be one of: `indexer`, `search_head`, or `cluster_master`. * `earliest` (optional): The earliest time for the search. Defaults to `-{collection_interval}` (e.g., `-10m` if collection\_interval is 10m). **Ignored if SPL already contains** `earliest=`**.** * `latest` (optional): The latest time for the search. Defaults to `now`. **Ignored if SPL already contains** `latest=`**.** * `metrics` (required): A list of metric definitions that map search result columns to OTel metrics. **Note on time ranges:** * For regular searches (like `index=_internal | stats count`), the receiver automatically adds `earliest` and `latest` time modifiers. * For generating commands that start with `|` (other than `| tstats`), no time range is added since these commands handle time differently. * Receiver will correctly add a time range to searches that **begin** with `| tstats` Each metric definition supports: * `metric_name` (required): The name of the metric to emit (e.g., `splunk.custom.event_count`). * `value_column` (required): The column name from the SPL results that contains the metric value. * `attribute_columns` (optional): List of column names to include as metric attributes. * `value_type` (optional): Either `int` (default) or `double`. * `unit` (optional): The unit of measurement (e.g., `{count}`, `By`, `%`). * `description` (optional): A description of the metric. * `static_attributes` (optional): Key-value pairs to add as static attributes to all data points. ### Different Collection Intervals All custom searches run at the same `collection_interval` as the built-in metrics. If you need searches to run at different intervals, configure multiple receiver instances: ```yaml theme={null} receivers: # Fast searches - 1 minute interval splunkenterprise/fast: collection_interval: 1m cluster_master: auth: authenticator: basicauth/cm endpoint: "https://cm:8089" searches: - spl: "| tstats count where index=* by index" target: cluster_master metrics: - metric_name: splunk.custom.index_event_count value_column: count attribute_columns: [index] # Slow searches - 10 minute interval splunkenterprise/slow: collection_interval: 10m cluster_master: auth: authenticator: basicauth/cm endpoint: "https://cm:8089" searches: - spl: | search index=_internal sourcetype=splunkd | stats count by host, component target: cluster_master metrics: - metric_name: splunk.custom.component_events value_column: count attribute_columns: [host, component] ``` ### Custom Search Example ```yaml theme={null} receivers: splunkenterprise: collection_interval: 10m cluster_master: auth: authenticator: basicauth/cm endpoint: "https://cm.example.com:8089" searches: # Regular search - time range auto-added from collection_interval - spl: "index=_internal | stats count by host" target: cluster_master metrics: - metric_name: splunk.custom.internal_events value_column: count attribute_columns: [host] value_type: int unit: "{events}" description: "Count of _internal events by host" # Custom time range - look back 1 hour - spl: "index=_audit | stats count by action" target: cluster_master earliest: "-1h" latest: "now" metrics: - metric_name: splunk.custom.audit_actions value_column: count attribute_columns: [action] value_type: int # tstats for fast indexed field searches - receiver injects earliest/latest automatically - spl: "| tstats count where index=* by index" target: cluster_master metrics: - metric_name: splunk.custom.index_event_count value_column: count attribute_columns: [index] value_type: int # REST API search - non-tstats generating commands (| rest, | makeresults, etc.) do NOT # receive automatic time injection; include time modifiers in the SPL if needed - spl: "| rest /services/server/info | fields serverName, numberOfCores" - spl: "| rest /services/server/info | fields serverName, numberOfCores" target: cluster_master metrics: - metric_name: splunk.custom.server_cores value_column: numberOfCores attribute_columns: [serverName] value_type: int static_attributes: search_source: "rest_api" ``` For a full list of settings exposed by this receiver please look in [config.go](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/splunkenterprisereceiver/config.go) with a detailed configuration in [testdata/config.yaml](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/splunkenterprisereceiver/testdata/config.yaml). ## Metrics | Metric Name | Description | Unit | Type | Attributes | | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ----- | --------------------------------------------------------------------------------------------------------------------------------- | | ❌ `splunk.aggregation.queue.ratio` | Gauge tracking the average indexer aggregation queue ration (%). *Note:*\* Search is best run against a Cluster Manager. | \{%} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.buckets.searchable.status` | Gauge tracking the number of buckets and their searchable status. *Note:*\* Search is best run against a Cluster Manager. | \{count} | Gauge | splunk.host, splunk.indexer.searchable, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.data.indexes.extended.bucket.count` | Count of buckets per index | \{buckets} | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.data.indexes.extended.bucket.event.count` | Count of events in this bucket super-directory. *Note:*\* Must be pointed at specific indexer `endpoint`. | \{events} | Gauge | splunk.index.name, splunk.bucket.dir, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.data.indexes.extended.bucket.hot.count` | (If size > 0) Number of hot buckets. *Note:*\* Must be pointed at specific indexer `endpoint`. | \{buckets} | Gauge | splunk.index.name, splunk.bucket.dir, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.data.indexes.extended.bucket.warm.count` | (If size > 0) Number of warm buckets. *Note:*\* Must be pointed at specific indexer `endpoint` and gathers metrics from only that indexer. | \{buckets} | Gauge | splunk.index.name, splunk.bucket.dir, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.data.indexes.extended.event.count` | Count of events for index, excluding frozen events. Approximately equal to the event\_count sum of all buckets. *Note:*\* Must be pointed at specific indexer `endpoint` and gathers metrics from only that indexer. | \{events} | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.data.indexes.extended.raw.size` | Size in bytes on disk of the ``/rawdata/ directories of all buckets in this index, excluding frozen *Note:*\* Must be pointed at specific indexer `endpoint` and gathers metrics from only that indexer. | By | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.data.indexes.extended.total.size` | Size in bytes on disk of this index *Note:*\* Must be pointed at specific indexer `endpoint` and gathers metrics from only that indexer. | By | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ✅ `splunk.health` | The status ('red', 'yellow', or 'green') of the Splunk server. Health of 'red' produces a 0 while all other colors produce a 1. | \{status} | Gauge | splunk.feature, splunk.feature.health, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexer.avg.rate` | Gauge tracking the average rate of indexed data. **Note:** Search is best run against a Cluster Manager. | KBy | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexer.cpu.time` | Gauge tracking the number of indexing process cpu seconds per instance | \{s} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexer.queue.ratio` | Gauge tracking the average indexer index queue ration (%). *Note:*\* Search is best run against a Cluster Manager. | \{%} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexer.raw.write.time` | Gauge tracking the number of raw write seconds per instance | \{s} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexer.rollingrestart.status` | The status of a rolling restart. | \{status} | Gauge | splunk.searchable.restart, splunk.rollingorrestart, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexer.throughput` | Gauge tracking average bytes per second throughput of indexer. *Note:*\* Must be pointed at specific indexer `endpoint` and gathers metrics from only that indexer. | By/s | Gauge | splunk.indexer.status, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexes.avg.size` | Gauge tracking the indexes and their average size (gb). *Note:*\* Search is best run against a Cluster Manager. | Gb | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexes.avg.usage` | Gauge tracking the indexes and their average usage (%). *Note:*\* Search is best run against a Cluster Manager. | \{%} | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexes.bucket.count` | Gauge tracking the indexes and their bucket counts. *Note:*\* Search is best run against a Cluster Manager. | \{count} | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexes.median.data.age` | Gauge tracking the indexes and their median data age (days). *Note:*\* Search is best run against a Cluster Manager. | \{days} | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.indexes.size` | Gauge tracking the indexes and their total size (gb). *Note:*\* Search is best run against a Cluster Manager. | Gb | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.io.avg.iops` | Gauge tracking the average IOPs used per instance | \{iops} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.kvstore.backup.status` | Backup and restore status of the KV store. | \{status} | Gauge | splunk.kvstore.status.value, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.kvstore.replication.status` | Replication status of the KV store. | \{status} | Gauge | splunk.kvstore.status.value, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.kvstore.status` | This is the overall status of the kvstore for the given deployment. | \{status} | Gauge | splunk.kvstore.storage.engine, splunk.kvstore.external, splunk.kvstore.status.value, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.license.expiration.seconds_remaining` | Gauge tracking the seconds remaining on any given Splunk License found via Splunk API. **Note:** This will only work on a Cluster Manager. | \{seconds} | Gauge | splunk.license.status, splunk.license.label, splunk.license.type, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.license.index.usage` | Gauge tracking the indexed license usage per index | By | Gauge | splunk.index.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.parse.queue.ratio` | Gauge tracking the average indexer parser queue ration (%). *Note:*\* Search is best run against a Cluster Manager. | \{%} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.pipeline.set.count` | Gauge tracking the number of pipeline sets per indexer. **Note:** Search is best run against a Cluster Manager. | KBy | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.scheduler.avg.execution.latency` | Gauge tracking the average execution latency of scheduled searches | \{ms} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.scheduler.avg.run.time` | Gauge tracking the average runtime of scheduled searches | \{ms} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.scheduler.completion.ratio` | Gauge tracking the ratio of completed to skipped scheduled searches | \{%} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.search.duration` | Gauge tracking the duration in seconds of the last search probe call. | \{status} | Gauge | splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.search.initiation` | Gauge tracking whether the last search probe successfully initiated a search. | \{status} | Gauge | splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.search.status` | Gauge tracking the dispatch status of the last search probe. | \{status} | Gauge | splunk.search.state, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.search.success` | Gauge tracking whether the last search probe call was successful with the dispatch state 'DONE'. | \{status} | Gauge | splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.introspection.queues.current` | Gauge tracking current length of queue. *Note:*\* Must be pointed at specific indexer `endpoint` and gathers metrics from only that indexer. | \{queues} | Gauge | splunk.queue.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.introspection.queues.current.bytes` | Gauge tracking current bytes waiting in queue. *Note:*\* Must be pointed at specific indexer `endpoint` and gathers metrics from only that indexer. | By | Gauge | splunk.queue.name, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.adhoc` | Gauge tracking number of ad hoc search artifacts currently on disk. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.adhoc.size` | Gauge total size (MB) of ad hoc search artifacts currently on disk. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.completed` | Gauge tracking number of artifacts currently on disk that belong to finished searches. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.completed.size` | Gauge total size (MB) of artifacts currently on disk that belong to finished searches. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.incomplete` | Gauge tracking number of artifacts currently on disk that belong to unfinished/running searches. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.incomplete.size` | Gauge total size (MB) of artifacts currently on disk that belong to unfinished/running searches. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.invalid` | Gauge tracking number of artifacts currently on disk that are not in a valid state, such as missing info.csv file, etc. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.job.cache.count` | Gauge tracking number search artifacts metadata stored in memory, available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.job.cache.size` | Gauge tracking, in megabytes, memory used to cache job status and job info of all search artifacts, available in builds 9.1.2312.207+ and 9.3.x+. | \{mb} | Gauge | splunk.host, splunk.searchartifacts.cache.type, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.savedsearches` | Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of scheduled search artifacts, how many different saved-searches they belong to. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.scheduled` | Gauge tracking number of scheduled search artifacts currently on disk. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.server.searchartifacts.scheduled.size` | Gauge total size (MB) of scheduled search artifacts currently on disk. Note:\* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | \{search\_artifacts} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | | ❌ `splunk.typing.queue.ratio` | Gauge tracking the average indexer typing queue ration (%). *Note:*\* Search is best run against a Cluster Manager. | \{%} | Gauge | splunk.host, splunk.splunkd.build, splunk.splunkd.version | ## Attributes | Attribute Name | Description | Type | Values | | ----------------------------------- | --------------------------------------------------------------------------------------------------- | ------ | ------ | | `splunk.bucket.dir` | The bucket super-directory (home, cold, thawed) for each index | string | | | `splunk.feature` | The Feature name from the Splunk Health Introspection Endpoint | string | | | `splunk.feature.health` | The Health (in color form) of a Splunk Feature from the Splunk Health Introspection Endpoint | string | | | `splunk.host` | The name of the splunk host | string | | | `splunk.index.name` | The name of the index reporting a specific KPI | string | | | `splunk.indexer.searchable` | The searchability status reported for a specific object | string | | | `splunk.indexer.status` | The status message reported for a specific object | string | | | `splunk.kvstore.external` | Value denoting if the KV store is using an external service | string | | | `splunk.kvstore.status.value` | The string value of the status returned when reporting on KV store using the introspection endpoint | string | | | `splunk.kvstore.storage.engine` | The backend storage used by the KV store | string | | | `splunk.license.label` | The label of the license. | string | | | `splunk.license.status` | The status of the license. | string | | | `splunk.license.type` | The type of license. | string | | | `splunk.queue.name` | The name of the queue reporting a specific KPI | string | | | `splunk.rollingorrestart` | Boolean that indicates if there is a rolling restart or rolling upgrade in progress. | bool | | | `splunk.search.state` | The dispatch state of the search | string | | | `splunk.searchable.restart` | Boolean that indicates if a searchable rolling restart/upgrade in progress.t | bool | | | `splunk.searchartifacts.cache.type` | The search artifacts cache type | string | | | `splunk.splunkd.build` | The build number for this Splunk instance version | string | | | `splunk.splunkd.version` | The splunkd version number | string | | ## Configuration ### Example Configuration ```yaml theme={null} # Example config for the Splunk Enterprise Receiver. basicauth/search_head: client_auth: username: admin password: securityFirst basicauth/indexer: client_auth: username: admin password: securityFirst1! splunk_enterprise: indexer: auth: authenticator: basicauth/indexer timeout: 10 search_head: auth: authenticator: basicauth/search_head # Also optional: metric settings metrics: splunk.license.index.usage: enabled: true splunk.indexer.throughput: enabled: false # Custom SPL searches (optional) searches: # Regular search - spl: "index=_internal sourcetype=splunkd | stats count by host" target: search_head metrics: - metric_name: splunk.custom.event.count value_column: count attribute_columns: - host value_type: int unit: "{count}" description: "Custom event count by host" # Custom time range - spl: "index=_audit | stats count by action" target: search_head earliest: "-42m" latest: "now" metrics: - metric_name: splunk.custom.audit.count value_column: count attribute_columns: - action value_type: int # Generating command - spl: "| tstats count where index=_* by index" target: indexer metrics: - metric_name: splunk.custom.index.count value_column: count attribute_columns: - index value_type: int ``` *** *Last generated: 2026-07-06*