[receiver/splunkenterprise] Adding Info Metrics

.chloggen/splunkenterprisereceiver-splunkd-info.yaml

@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: splunkenterprisereceiver
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Add splunkd build info metrics
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: []
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user]

receiver/splunkenterprisereceiver/documentation.md

@@ -448,6 +448,22 @@ This is the overall status of the kvstore for the given deployment.
 | splunk.kvstore.external | Value denoting if the KV store is using an external service. | Any Str |
 | splunk.kvstore.status.value | The string value of the status returned when reporting on KV store using the introspection endpoint | Any Str |
 
+### splunk.server.info.build
+
+Gauge tracking splunkd build information.
+
+| Unit | Metric Type | Value Type |
+| ---- | ----------- | ---------- |
+| {splunkd_build} | Gauge | Int |
+
+#### Attributes
+
+| Name | Description | Values |
+| ---- | ----------- | ------ |
+| splunk.host | The name of the splunk host | Any Str |
+| splunk.build_info | The build of Splunk. | Any Str |
+| splunk.version | The version of Splunk. | Any Str |
+
 ### splunk.server.introspection.queues.current
 
 Gauge tracking current length of queue. *Note:** Must be pointed at specific indexer `endpoint` and gathers metrics from only that indexer.

receiver/splunkenterprisereceiver/internal/metadata/testdata/config.yaml

@@ -59,6 +59,8 @@ all_set:
       enabled: true
     splunk.scheduler.completion.ratio:
       enabled: true
+    splunk.server.info.build:
+      enabled: true
     splunk.server.introspection.queues.current:
       enabled: true
     splunk.server.introspection.queues.current.bytes:
@@ -137,6 +139,8 @@ none_set:
       enabled: false
     splunk.scheduler.completion.ratio:
       enabled: false
+    splunk.server.info.build:
+      enabled: false
     splunk.server.introspection.queues.current:
       enabled: false
     splunk.server.introspection.queues.current.bytes:

receiver/splunkenterprisereceiver/metadata.yaml

@@ -36,6 +36,12 @@ attributes:
   splunk.kvstore.storage.engine:
     description: The backend storage used by the KV store.
     type: string
+  splunk.build_info:
+    description: The build of Splunk.
+    type: string
+  splunk.version:
+    description: The version of Splunk.
+    type: string
 
 metrics:
   splunk.license.index.usage:
@@ -324,6 +330,15 @@ metrics:
       aggregation_temporality: cumulative
       value_type: int
     attributes: [splunk.host]
+  splunk.server.info.build:
+    enabled: false
+    description: Gauge tracking splunkd build information.
+    unit: "{splunkd_build}"
+    gauge:
+      monotonic: false
+      aggregation_temporality: cumulative
+      value_type: int
+    attributes: [splunk.host, splunk.build_info, splunk.version]
 
 tests:
   config:

receiver/splunkenterprisereceiver/scraper.go

@@ -1666,47 +1666,47 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T
 
 	for _, f := range da.Entries {
 
-		if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsAdhoc.Enabled {
+		if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsAdhoc.Enabled {
 			adhocCount, err := strconv.ParseInt(f.Content.AdhocCount, 10, 64)
 			if err != nil {
 				errs <- err
 			}
 			s.mb.RecordSplunkServerSearchartifactsAdhocDataPoint(now, adhocCount, s.conf.SHEndpoint.Endpoint)
 		}
 
-		if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsScheduled.Enabled {
+		if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsScheduled.Enabled {
 			scheduledCount, err := strconv.ParseInt(f.Content.ScheduledCount, 10, 64)
 			if err != nil {
 				errs <- err
 			}
 			s.mb.RecordSplunkServerSearchartifactsScheduledDataPoint(now, scheduledCount, s.conf.SHEndpoint.Endpoint)
 		}
 
-		if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsCompleted.Enabled {
+		if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsCompleted.Enabled {
 			completedCount, err := strconv.ParseInt(f.Content.CompletedCount, 10, 64)
 			if err != nil {
 				errs <- err
 			}
 			s.mb.RecordSplunkServerSearchartifactsCompletedDataPoint(now, completedCount, s.conf.SHEndpoint.Endpoint)
 		}
 
-		if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsIncomplete.Enabled {
+		if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsIncomplete.Enabled {
 			incompleCount, err := strconv.ParseInt(f.Content.IncompleCount, 10, 64)
 			if err != nil {
 				errs <- err
 			}
 			s.mb.RecordSplunkServerSearchartifactsIncompleteDataPoint(now, incompleCount, s.conf.SHEndpoint.Endpoint)
 		}
 
-		if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsInvalid.Enabled {
+		if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsInvalid.Enabled {
 			invalidCount, err := strconv.ParseInt(f.Content.InvalidCount, 10, 64)
 			if err != nil {
 				errs <- err
 			}
 			s.mb.RecordSplunkServerSearchartifactsInvalidDataPoint(now, invalidCount, s.conf.SHEndpoint.Endpoint)
 		}
 
-		if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsSavedsearches.Enabled {
+		if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsSavedsearches.Enabled {
 			savedSearchesCount, err := strconv.ParseInt(f.Content.SsCount, 10, 64)
 			if err != nil {
 				errs <- err
@@ -1715,3 +1715,43 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T
 		}
 	}
 }
+
+// Scrape info endpoints
+func (s *splunkScraper) scrapeInfo(ctx context.Context, now pcommon.Timestamp, errs chan error) {
+
+	ctx = context.WithValue(ctx)
+	var info Info
+
+	ept := apiDict[`SplunkInfo`]
+
+	req, err := s.splunkClient.createAPIRequest(ctx, ept)
+	if err != nil {
+		errs <- err
+		return
+	}
+
+	res, err := s.splunkClient.makeRequest(req)
+	if err != nil {
+		errs <- err
+		return
+	}
+	defer res.Body.Close()
+
+	body, err := io.ReadAll(res.Body)
+	if err != nil {
+		errs <- err
+		return
+	}
+	err = json.Unmarshal(body, &da)
+	if err != nil {
+		errs <- err
+		return
+	}
+
+	for _, f := range info.Entries {
+
+		if s.conf.MetricsBuilderConfig.Metrics.SplunkServerInfo.Enabled {
+			s.mb.RecordSplunkServerInfoDataPoint(now, 1, info.Host, f.Content.Build, f.Content.Version)
+		}
+	}
+}

receiver/splunkenterprisereceiver/search_result.go

@@ -20,6 +20,7 @@ var searchDict = map[string]string{
 }
 
 var apiDict = map[string]string{
+	`SplunkInfo`:                `/services/server/info?output_mode=json`,
 	`SplunkIndexerThroughput`:   `/services/server/introspection/indexer?output_mode=json`,
 	`SplunkDataIndexesExtended`: `/services/data/indexes-extended?output_mode=json&count=-1`,
 	`SplunkIntrospectionQueues`: `/services/server/introspection/queues?output_mode=json&count=-1`,
@@ -153,3 +154,18 @@ type DispatchArtifactContent struct {
 	IncompleCount  string `json:"incomple_count"`
 	InvalidCount   string `json:"invalid_count"`
 }
+
+// '/services/server/info'
+type Info struct {
+	Host    string      `json:"origin"`
+	Entries []InfoEntry `json:"entry"`
+}
+
+type InfoEntry struct {
+	Content InfoContent `json:"content"`
+}
+
+type InfoContent struct {
+	Build   string `json:"build"`
+	Version string `json:"version"`
+}