From a1db725b4dc576b30f0a60470ec14cf75e204ed7 Mon Sep 17 00:00:00 2001 From: Michael Burt Date: Mon, 4 Nov 2024 16:18:27 -0700 Subject: [PATCH 1/5] [receiver/splunkenterprise] Adding Search Artifact Cache Metrics --- .../splunkenterprisereceiver/documentation.md | 41 +++++- .../internal/metadata/generated_config.go | 8 ++ .../metadata/generated_config_test.go | 4 + .../internal/metadata/generated_metrics.go | 131 +++++++++++++++++- .../metadata/generated_metrics_test.go | 51 ++++++- .../internal/metadata/testdata/config.yaml | 8 ++ .../splunkenterprisereceiver/metadata.yaml | 33 ++++- receiver/splunkenterprisereceiver/scraper.go | 34 ++++- .../splunkenterprisereceiver/search_result.go | 15 +- 9 files changed, 289 insertions(+), 36 deletions(-) diff --git a/receiver/splunkenterprisereceiver/documentation.md b/receiver/splunkenterprisereceiver/documentation.md index e866054e5627..81317c1395af 100644 --- a/receiver/splunkenterprisereceiver/documentation.md +++ b/receiver/splunkenterprisereceiver/documentation.md @@ -478,7 +478,7 @@ Gauge tracking current bytes waiting in queue. *Note:** Must be pointed at speci ### splunk.server.searchartifacts.adhoc -Gauge tracking number of ad hoc search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. +Gauge tracking number of ad hoc search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | Unit | Metric Type | Value Type | | ---- | ----------- | ---------- | @@ -492,7 +492,7 @@ Gauge tracking number of ad hoc search artifacts currently on disk. Note:* Must ### splunk.server.searchartifacts.completed -Gauge tracking number of artifacts currently on disk that belong to finished searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. +Gauge tracking number of artifacts currently on disk that belong to finished searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | Unit | Metric Type | Value Type | | ---- | ----------- | ---------- | @@ -506,7 +506,7 @@ Gauge tracking number of artifacts currently on disk that belong to finished sea ### splunk.server.searchartifacts.incomplete -Gauge tracking number of artifacts currently on disk that belong to unfinished/running searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. +Gauge tracking number of artifacts currently on disk that belong to unfinished/running searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | Unit | Metric Type | Value Type | | ---- | ----------- | ---------- | @@ -520,7 +520,7 @@ Gauge tracking number of artifacts currently on disk that belong to unfinished/r ### splunk.server.searchartifacts.invalid -Gauge tracking number of artifacts currently on disk that are not in a valid state, such as missing info.csv file, etc. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. +Gauge tracking number of artifacts currently on disk that are not in a valid state, such as missing info.csv file, etc. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | Unit | Metric Type | Value Type | | ---- | ----------- | ---------- | @@ -532,9 +532,38 @@ Gauge tracking number of artifacts currently on disk that are not in a valid sta | ---- | ----------- | ------ | | splunk.host | The name of the splunk host | Any Str | +### splunk.server.searchartifacts.job.cache.count + +Gauge tracking number search artifacts metadata stored in memory, available in builds 9.1.2312.207+ and 9.3.x+. + +| Unit | Metric Type | Value Type | +| ---- | ----------- | ---------- | +| {search_artifacts} | Gauge | Int | + +#### Attributes + +| Name | Description | Values | +| ---- | ----------- | ------ | +| splunk.host | The name of the splunk host | Any Str | + +### splunk.server.searchartifacts.job.cache.size + +Gauge tracking, in megabytes, memory used to cache job status and job info of all search artifacts, available in builds 9.1.2312.207+ and 9.3.x+. + +| Unit | Metric Type | Value Type | +| ---- | ----------- | ---------- | +| {mb} | Gauge | Int | + +#### Attributes + +| Name | Description | Values | +| ---- | ----------- | ------ | +| splunk.host | The name of the splunk host | Any Str | +| splunk.searchartifacts.cache.type | The search artifacts cache type. | Any Str | + ### splunk.server.searchartifacts.savedsearches -Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of scheduled search artifacts, how many different saved-searches they belong to. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. +Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of scheduled search artifacts, how many different saved-searches they belong to. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | Unit | Metric Type | Value Type | | ---- | ----------- | ---------- | @@ -548,7 +577,7 @@ Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of sche ### splunk.server.searchartifacts.scheduled -Gauge tracking number of scheduled search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. +Gauge tracking number of scheduled search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. | Unit | Metric Type | Value Type | | ---- | ----------- | ---------- | diff --git a/receiver/splunkenterprisereceiver/internal/metadata/generated_config.go b/receiver/splunkenterprisereceiver/internal/metadata/generated_config.go index 9daf22b30999..4ea3c87bfe5c 100644 --- a/receiver/splunkenterprisereceiver/internal/metadata/generated_config.go +++ b/receiver/splunkenterprisereceiver/internal/metadata/generated_config.go @@ -62,6 +62,8 @@ type MetricsConfig struct { SplunkServerSearchartifactsCompleted MetricConfig `mapstructure:"splunk.server.searchartifacts.completed"` SplunkServerSearchartifactsIncomplete MetricConfig `mapstructure:"splunk.server.searchartifacts.incomplete"` SplunkServerSearchartifactsInvalid MetricConfig `mapstructure:"splunk.server.searchartifacts.invalid"` + SplunkServerSearchartifactsJobCacheCount MetricConfig `mapstructure:"splunk.server.searchartifacts.job.cache.count"` + SplunkServerSearchartifactsJobCacheSize MetricConfig `mapstructure:"splunk.server.searchartifacts.job.cache.size"` SplunkServerSearchartifactsSavedsearches MetricConfig `mapstructure:"splunk.server.searchartifacts.savedsearches"` SplunkServerSearchartifactsScheduled MetricConfig `mapstructure:"splunk.server.searchartifacts.scheduled"` SplunkTypingQueueRatio MetricConfig `mapstructure:"splunk.typing.queue.ratio"` @@ -174,6 +176,12 @@ func DefaultMetricsConfig() MetricsConfig { SplunkServerSearchartifactsInvalid: MetricConfig{ Enabled: false, }, + SplunkServerSearchartifactsJobCacheCount: MetricConfig{ + Enabled: false, + }, + SplunkServerSearchartifactsJobCacheSize: MetricConfig{ + Enabled: false, + }, SplunkServerSearchartifactsSavedsearches: MetricConfig{ Enabled: false, }, diff --git a/receiver/splunkenterprisereceiver/internal/metadata/generated_config_test.go b/receiver/splunkenterprisereceiver/internal/metadata/generated_config_test.go index 9b1dc2b53099..c94a8ac39302 100644 --- a/receiver/splunkenterprisereceiver/internal/metadata/generated_config_test.go +++ b/receiver/splunkenterprisereceiver/internal/metadata/generated_config_test.go @@ -60,6 +60,8 @@ func TestMetricsBuilderConfig(t *testing.T) { SplunkServerSearchartifactsCompleted: MetricConfig{Enabled: true}, SplunkServerSearchartifactsIncomplete: MetricConfig{Enabled: true}, SplunkServerSearchartifactsInvalid: MetricConfig{Enabled: true}, + SplunkServerSearchartifactsJobCacheCount: MetricConfig{Enabled: true}, + SplunkServerSearchartifactsJobCacheSize: MetricConfig{Enabled: true}, SplunkServerSearchartifactsSavedsearches: MetricConfig{Enabled: true}, SplunkServerSearchartifactsScheduled: MetricConfig{Enabled: true}, SplunkTypingQueueRatio: MetricConfig{Enabled: true}, @@ -105,6 +107,8 @@ func TestMetricsBuilderConfig(t *testing.T) { SplunkServerSearchartifactsCompleted: MetricConfig{Enabled: false}, SplunkServerSearchartifactsIncomplete: MetricConfig{Enabled: false}, SplunkServerSearchartifactsInvalid: MetricConfig{Enabled: false}, + SplunkServerSearchartifactsJobCacheCount: MetricConfig{Enabled: false}, + SplunkServerSearchartifactsJobCacheSize: MetricConfig{Enabled: false}, SplunkServerSearchartifactsSavedsearches: MetricConfig{Enabled: false}, SplunkServerSearchartifactsScheduled: MetricConfig{Enabled: false}, SplunkTypingQueueRatio: MetricConfig{Enabled: false}, diff --git a/receiver/splunkenterprisereceiver/internal/metadata/generated_metrics.go b/receiver/splunkenterprisereceiver/internal/metadata/generated_metrics.go index 968f9b26bed2..c6d6e18c8d5b 100644 --- a/receiver/splunkenterprisereceiver/internal/metadata/generated_metrics.go +++ b/receiver/splunkenterprisereceiver/internal/metadata/generated_metrics.go @@ -1607,7 +1607,7 @@ type metricSplunkServerSearchartifactsAdhoc struct { // init fills splunk.server.searchartifacts.adhoc metric with initial data. func (m *metricSplunkServerSearchartifactsAdhoc) init() { m.data.SetName("splunk.server.searchartifacts.adhoc") - m.data.SetDescription("Gauge tracking number of ad hoc search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.") + m.data.SetDescription("Gauge tracking number of ad hoc search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.") m.data.SetUnit("{search_artifacts}") m.data.SetEmptyGauge() m.data.Gauge().DataPoints().EnsureCapacity(m.capacity) @@ -1658,7 +1658,7 @@ type metricSplunkServerSearchartifactsCompleted struct { // init fills splunk.server.searchartifacts.completed metric with initial data. func (m *metricSplunkServerSearchartifactsCompleted) init() { m.data.SetName("splunk.server.searchartifacts.completed") - m.data.SetDescription("Gauge tracking number of artifacts currently on disk that belong to finished searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.") + m.data.SetDescription("Gauge tracking number of artifacts currently on disk that belong to finished searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.") m.data.SetUnit("{search_artifacts}") m.data.SetEmptyGauge() m.data.Gauge().DataPoints().EnsureCapacity(m.capacity) @@ -1709,7 +1709,7 @@ type metricSplunkServerSearchartifactsIncomplete struct { // init fills splunk.server.searchartifacts.incomplete metric with initial data. func (m *metricSplunkServerSearchartifactsIncomplete) init() { m.data.SetName("splunk.server.searchartifacts.incomplete") - m.data.SetDescription("Gauge tracking number of artifacts currently on disk that belong to unfinished/running searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.") + m.data.SetDescription("Gauge tracking number of artifacts currently on disk that belong to unfinished/running searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.") m.data.SetUnit("{search_artifacts}") m.data.SetEmptyGauge() m.data.Gauge().DataPoints().EnsureCapacity(m.capacity) @@ -1760,7 +1760,7 @@ type metricSplunkServerSearchartifactsInvalid struct { // init fills splunk.server.searchartifacts.invalid metric with initial data. func (m *metricSplunkServerSearchartifactsInvalid) init() { m.data.SetName("splunk.server.searchartifacts.invalid") - m.data.SetDescription("Gauge tracking number of artifacts currently on disk that are not in a valid state, such as missing info.csv file, etc. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.") + m.data.SetDescription("Gauge tracking number of artifacts currently on disk that are not in a valid state, such as missing info.csv file, etc. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.") m.data.SetUnit("{search_artifacts}") m.data.SetEmptyGauge() m.data.Gauge().DataPoints().EnsureCapacity(m.capacity) @@ -1802,6 +1802,109 @@ func newMetricSplunkServerSearchartifactsInvalid(cfg MetricConfig) metricSplunkS return m } +type metricSplunkServerSearchartifactsJobCacheCount struct { + data pmetric.Metric // data buffer for generated metric. + config MetricConfig // metric config provided by user. + capacity int // max observed number of data points added to the metric. +} + +// init fills splunk.server.searchartifacts.job.cache.count metric with initial data. +func (m *metricSplunkServerSearchartifactsJobCacheCount) init() { + m.data.SetName("splunk.server.searchartifacts.job.cache.count") + m.data.SetDescription("Gauge tracking number search artifacts metadata stored in memory, available in builds 9.1.2312.207+ and 9.3.x+.") + m.data.SetUnit("{search_artifacts}") + m.data.SetEmptyGauge() + m.data.Gauge().DataPoints().EnsureCapacity(m.capacity) +} + +func (m *metricSplunkServerSearchartifactsJobCacheCount) recordDataPoint(start pcommon.Timestamp, ts pcommon.Timestamp, val int64, splunkHostAttributeValue string) { + if !m.config.Enabled { + return + } + dp := m.data.Gauge().DataPoints().AppendEmpty() + dp.SetStartTimestamp(start) + dp.SetTimestamp(ts) + dp.SetIntValue(val) + dp.Attributes().PutStr("splunk.host", splunkHostAttributeValue) +} + +// updateCapacity saves max length of data point slices that will be used for the slice capacity. +func (m *metricSplunkServerSearchartifactsJobCacheCount) updateCapacity() { + if m.data.Gauge().DataPoints().Len() > m.capacity { + m.capacity = m.data.Gauge().DataPoints().Len() + } +} + +// emit appends recorded metric data to a metrics slice and prepares it for recording another set of data points. +func (m *metricSplunkServerSearchartifactsJobCacheCount) emit(metrics pmetric.MetricSlice) { + if m.config.Enabled && m.data.Gauge().DataPoints().Len() > 0 { + m.updateCapacity() + m.data.MoveTo(metrics.AppendEmpty()) + m.init() + } +} + +func newMetricSplunkServerSearchartifactsJobCacheCount(cfg MetricConfig) metricSplunkServerSearchartifactsJobCacheCount { + m := metricSplunkServerSearchartifactsJobCacheCount{config: cfg} + if cfg.Enabled { + m.data = pmetric.NewMetric() + m.init() + } + return m +} + +type metricSplunkServerSearchartifactsJobCacheSize struct { + data pmetric.Metric // data buffer for generated metric. + config MetricConfig // metric config provided by user. + capacity int // max observed number of data points added to the metric. +} + +// init fills splunk.server.searchartifacts.job.cache.size metric with initial data. +func (m *metricSplunkServerSearchartifactsJobCacheSize) init() { + m.data.SetName("splunk.server.searchartifacts.job.cache.size") + m.data.SetDescription("Gauge tracking, in megabytes, memory used to cache job status and job info of all search artifacts, available in builds 9.1.2312.207+ and 9.3.x+.") + m.data.SetUnit("{mb}") + m.data.SetEmptyGauge() + m.data.Gauge().DataPoints().EnsureCapacity(m.capacity) +} + +func (m *metricSplunkServerSearchartifactsJobCacheSize) recordDataPoint(start pcommon.Timestamp, ts pcommon.Timestamp, val int64, splunkHostAttributeValue string, splunkSearchartifactsCacheTypeAttributeValue string) { + if !m.config.Enabled { + return + } + dp := m.data.Gauge().DataPoints().AppendEmpty() + dp.SetStartTimestamp(start) + dp.SetTimestamp(ts) + dp.SetIntValue(val) + dp.Attributes().PutStr("splunk.host", splunkHostAttributeValue) + dp.Attributes().PutStr("splunk.searchartifacts.cache.type", splunkSearchartifactsCacheTypeAttributeValue) +} + +// updateCapacity saves max length of data point slices that will be used for the slice capacity. +func (m *metricSplunkServerSearchartifactsJobCacheSize) updateCapacity() { + if m.data.Gauge().DataPoints().Len() > m.capacity { + m.capacity = m.data.Gauge().DataPoints().Len() + } +} + +// emit appends recorded metric data to a metrics slice and prepares it for recording another set of data points. +func (m *metricSplunkServerSearchartifactsJobCacheSize) emit(metrics pmetric.MetricSlice) { + if m.config.Enabled && m.data.Gauge().DataPoints().Len() > 0 { + m.updateCapacity() + m.data.MoveTo(metrics.AppendEmpty()) + m.init() + } +} + +func newMetricSplunkServerSearchartifactsJobCacheSize(cfg MetricConfig) metricSplunkServerSearchartifactsJobCacheSize { + m := metricSplunkServerSearchartifactsJobCacheSize{config: cfg} + if cfg.Enabled { + m.data = pmetric.NewMetric() + m.init() + } + return m +} + type metricSplunkServerSearchartifactsSavedsearches struct { data pmetric.Metric // data buffer for generated metric. config MetricConfig // metric config provided by user. @@ -1811,7 +1914,7 @@ type metricSplunkServerSearchartifactsSavedsearches struct { // init fills splunk.server.searchartifacts.savedsearches metric with initial data. func (m *metricSplunkServerSearchartifactsSavedsearches) init() { m.data.SetName("splunk.server.searchartifacts.savedsearches") - m.data.SetDescription("Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of scheduled search artifacts, how many different saved-searches they belong to. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.") + m.data.SetDescription("Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of scheduled search artifacts, how many different saved-searches they belong to. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.") m.data.SetUnit("{search_artifacts}") m.data.SetEmptyGauge() m.data.Gauge().DataPoints().EnsureCapacity(m.capacity) @@ -1862,7 +1965,7 @@ type metricSplunkServerSearchartifactsScheduled struct { // init fills splunk.server.searchartifacts.scheduled metric with initial data. func (m *metricSplunkServerSearchartifactsScheduled) init() { m.data.SetName("splunk.server.searchartifacts.scheduled") - m.data.SetDescription("Gauge tracking number of scheduled search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.") + m.data.SetDescription("Gauge tracking number of scheduled search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.") m.data.SetUnit("{search_artifacts}") m.data.SetEmptyGauge() m.data.Gauge().DataPoints().EnsureCapacity(m.capacity) @@ -1998,6 +2101,8 @@ type MetricsBuilder struct { metricSplunkServerSearchartifactsCompleted metricSplunkServerSearchartifactsCompleted metricSplunkServerSearchartifactsIncomplete metricSplunkServerSearchartifactsIncomplete metricSplunkServerSearchartifactsInvalid metricSplunkServerSearchartifactsInvalid + metricSplunkServerSearchartifactsJobCacheCount metricSplunkServerSearchartifactsJobCacheCount + metricSplunkServerSearchartifactsJobCacheSize metricSplunkServerSearchartifactsJobCacheSize metricSplunkServerSearchartifactsSavedsearches metricSplunkServerSearchartifactsSavedsearches metricSplunkServerSearchartifactsScheduled metricSplunkServerSearchartifactsScheduled metricSplunkTypingQueueRatio metricSplunkTypingQueueRatio @@ -2062,6 +2167,8 @@ func NewMetricsBuilder(mbc MetricsBuilderConfig, settings receiver.Settings, opt metricSplunkServerSearchartifactsCompleted: newMetricSplunkServerSearchartifactsCompleted(mbc.Metrics.SplunkServerSearchartifactsCompleted), metricSplunkServerSearchartifactsIncomplete: newMetricSplunkServerSearchartifactsIncomplete(mbc.Metrics.SplunkServerSearchartifactsIncomplete), metricSplunkServerSearchartifactsInvalid: newMetricSplunkServerSearchartifactsInvalid(mbc.Metrics.SplunkServerSearchartifactsInvalid), + metricSplunkServerSearchartifactsJobCacheCount: newMetricSplunkServerSearchartifactsJobCacheCount(mbc.Metrics.SplunkServerSearchartifactsJobCacheCount), + metricSplunkServerSearchartifactsJobCacheSize: newMetricSplunkServerSearchartifactsJobCacheSize(mbc.Metrics.SplunkServerSearchartifactsJobCacheSize), metricSplunkServerSearchartifactsSavedsearches: newMetricSplunkServerSearchartifactsSavedsearches(mbc.Metrics.SplunkServerSearchartifactsSavedsearches), metricSplunkServerSearchartifactsScheduled: newMetricSplunkServerSearchartifactsScheduled(mbc.Metrics.SplunkServerSearchartifactsScheduled), metricSplunkTypingQueueRatio: newMetricSplunkTypingQueueRatio(mbc.Metrics.SplunkTypingQueueRatio), @@ -2165,6 +2272,8 @@ func (mb *MetricsBuilder) EmitForResource(options ...ResourceMetricsOption) { mb.metricSplunkServerSearchartifactsCompleted.emit(ils.Metrics()) mb.metricSplunkServerSearchartifactsIncomplete.emit(ils.Metrics()) mb.metricSplunkServerSearchartifactsInvalid.emit(ils.Metrics()) + mb.metricSplunkServerSearchartifactsJobCacheCount.emit(ils.Metrics()) + mb.metricSplunkServerSearchartifactsJobCacheSize.emit(ils.Metrics()) mb.metricSplunkServerSearchartifactsSavedsearches.emit(ils.Metrics()) mb.metricSplunkServerSearchartifactsScheduled.emit(ils.Metrics()) mb.metricSplunkTypingQueueRatio.emit(ils.Metrics()) @@ -2364,6 +2473,16 @@ func (mb *MetricsBuilder) RecordSplunkServerSearchartifactsInvalidDataPoint(ts p mb.metricSplunkServerSearchartifactsInvalid.recordDataPoint(mb.startTime, ts, val, splunkHostAttributeValue) } +// RecordSplunkServerSearchartifactsJobCacheCountDataPoint adds a data point to splunk.server.searchartifacts.job.cache.count metric. +func (mb *MetricsBuilder) RecordSplunkServerSearchartifactsJobCacheCountDataPoint(ts pcommon.Timestamp, val int64, splunkHostAttributeValue string) { + mb.metricSplunkServerSearchartifactsJobCacheCount.recordDataPoint(mb.startTime, ts, val, splunkHostAttributeValue) +} + +// RecordSplunkServerSearchartifactsJobCacheSizeDataPoint adds a data point to splunk.server.searchartifacts.job.cache.size metric. +func (mb *MetricsBuilder) RecordSplunkServerSearchartifactsJobCacheSizeDataPoint(ts pcommon.Timestamp, val int64, splunkHostAttributeValue string, splunkSearchartifactsCacheTypeAttributeValue string) { + mb.metricSplunkServerSearchartifactsJobCacheSize.recordDataPoint(mb.startTime, ts, val, splunkHostAttributeValue, splunkSearchartifactsCacheTypeAttributeValue) +} + // RecordSplunkServerSearchartifactsSavedsearchesDataPoint adds a data point to splunk.server.searchartifacts.savedsearches metric. func (mb *MetricsBuilder) RecordSplunkServerSearchartifactsSavedsearchesDataPoint(ts pcommon.Timestamp, val int64, splunkHostAttributeValue string) { mb.metricSplunkServerSearchartifactsSavedsearches.recordDataPoint(mb.startTime, ts, val, splunkHostAttributeValue) diff --git a/receiver/splunkenterprisereceiver/internal/metadata/generated_metrics_test.go b/receiver/splunkenterprisereceiver/internal/metadata/generated_metrics_test.go index b2c7ede854dc..76406e0fdbb8 100644 --- a/receiver/splunkenterprisereceiver/internal/metadata/generated_metrics_test.go +++ b/receiver/splunkenterprisereceiver/internal/metadata/generated_metrics_test.go @@ -182,6 +182,12 @@ func TestMetricsBuilder(t *testing.T) { allMetricsCount++ mb.RecordSplunkServerSearchartifactsInvalidDataPoint(ts, 1, "splunk.host-val") + allMetricsCount++ + mb.RecordSplunkServerSearchartifactsJobCacheCountDataPoint(ts, 1, "splunk.host-val") + + allMetricsCount++ + mb.RecordSplunkServerSearchartifactsJobCacheSizeDataPoint(ts, 1, "splunk.host-val", "splunk.searchartifacts.cache.type-val") + allMetricsCount++ mb.RecordSplunkServerSearchartifactsSavedsearchesDataPoint(ts, 1, "splunk.host-val") @@ -702,7 +708,7 @@ func TestMetricsBuilder(t *testing.T) { validatedMetrics["splunk.server.searchartifacts.adhoc"] = true assert.Equal(t, pmetric.MetricTypeGauge, ms.At(i).Type()) assert.Equal(t, 1, ms.At(i).Gauge().DataPoints().Len()) - assert.Equal(t, "Gauge tracking number of ad hoc search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.", ms.At(i).Description()) + assert.Equal(t, "Gauge tracking number of ad hoc search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.", ms.At(i).Description()) assert.Equal(t, "{search_artifacts}", ms.At(i).Unit()) dp := ms.At(i).Gauge().DataPoints().At(0) assert.Equal(t, start, dp.StartTimestamp()) @@ -717,7 +723,7 @@ func TestMetricsBuilder(t *testing.T) { validatedMetrics["splunk.server.searchartifacts.completed"] = true assert.Equal(t, pmetric.MetricTypeGauge, ms.At(i).Type()) assert.Equal(t, 1, ms.At(i).Gauge().DataPoints().Len()) - assert.Equal(t, "Gauge tracking number of artifacts currently on disk that belong to finished searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.", ms.At(i).Description()) + assert.Equal(t, "Gauge tracking number of artifacts currently on disk that belong to finished searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.", ms.At(i).Description()) assert.Equal(t, "{search_artifacts}", ms.At(i).Unit()) dp := ms.At(i).Gauge().DataPoints().At(0) assert.Equal(t, start, dp.StartTimestamp()) @@ -732,7 +738,7 @@ func TestMetricsBuilder(t *testing.T) { validatedMetrics["splunk.server.searchartifacts.incomplete"] = true assert.Equal(t, pmetric.MetricTypeGauge, ms.At(i).Type()) assert.Equal(t, 1, ms.At(i).Gauge().DataPoints().Len()) - assert.Equal(t, "Gauge tracking number of artifacts currently on disk that belong to unfinished/running searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.", ms.At(i).Description()) + assert.Equal(t, "Gauge tracking number of artifacts currently on disk that belong to unfinished/running searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.", ms.At(i).Description()) assert.Equal(t, "{search_artifacts}", ms.At(i).Unit()) dp := ms.At(i).Gauge().DataPoints().At(0) assert.Equal(t, start, dp.StartTimestamp()) @@ -747,7 +753,22 @@ func TestMetricsBuilder(t *testing.T) { validatedMetrics["splunk.server.searchartifacts.invalid"] = true assert.Equal(t, pmetric.MetricTypeGauge, ms.At(i).Type()) assert.Equal(t, 1, ms.At(i).Gauge().DataPoints().Len()) - assert.Equal(t, "Gauge tracking number of artifacts currently on disk that are not in a valid state, such as missing info.csv file, etc. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.", ms.At(i).Description()) + assert.Equal(t, "Gauge tracking number of artifacts currently on disk that are not in a valid state, such as missing info.csv file, etc. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.", ms.At(i).Description()) + assert.Equal(t, "{search_artifacts}", ms.At(i).Unit()) + dp := ms.At(i).Gauge().DataPoints().At(0) + assert.Equal(t, start, dp.StartTimestamp()) + assert.Equal(t, ts, dp.Timestamp()) + assert.Equal(t, pmetric.NumberDataPointValueTypeInt, dp.ValueType()) + assert.Equal(t, int64(1), dp.IntValue()) + attrVal, ok := dp.Attributes().Get("splunk.host") + assert.True(t, ok) + assert.EqualValues(t, "splunk.host-val", attrVal.Str()) + case "splunk.server.searchartifacts.job.cache.count": + assert.False(t, validatedMetrics["splunk.server.searchartifacts.job.cache.count"], "Found a duplicate in the metrics slice: splunk.server.searchartifacts.job.cache.count") + validatedMetrics["splunk.server.searchartifacts.job.cache.count"] = true + assert.Equal(t, pmetric.MetricTypeGauge, ms.At(i).Type()) + assert.Equal(t, 1, ms.At(i).Gauge().DataPoints().Len()) + assert.Equal(t, "Gauge tracking number search artifacts metadata stored in memory, available in builds 9.1.2312.207+ and 9.3.x+.", ms.At(i).Description()) assert.Equal(t, "{search_artifacts}", ms.At(i).Unit()) dp := ms.At(i).Gauge().DataPoints().At(0) assert.Equal(t, start, dp.StartTimestamp()) @@ -757,12 +778,30 @@ func TestMetricsBuilder(t *testing.T) { attrVal, ok := dp.Attributes().Get("splunk.host") assert.True(t, ok) assert.EqualValues(t, "splunk.host-val", attrVal.Str()) + case "splunk.server.searchartifacts.job.cache.size": + assert.False(t, validatedMetrics["splunk.server.searchartifacts.job.cache.size"], "Found a duplicate in the metrics slice: splunk.server.searchartifacts.job.cache.size") + validatedMetrics["splunk.server.searchartifacts.job.cache.size"] = true + assert.Equal(t, pmetric.MetricTypeGauge, ms.At(i).Type()) + assert.Equal(t, 1, ms.At(i).Gauge().DataPoints().Len()) + assert.Equal(t, "Gauge tracking, in megabytes, memory used to cache job status and job info of all search artifacts, available in builds 9.1.2312.207+ and 9.3.x+.", ms.At(i).Description()) + assert.Equal(t, "{mb}", ms.At(i).Unit()) + dp := ms.At(i).Gauge().DataPoints().At(0) + assert.Equal(t, start, dp.StartTimestamp()) + assert.Equal(t, ts, dp.Timestamp()) + assert.Equal(t, pmetric.NumberDataPointValueTypeInt, dp.ValueType()) + assert.Equal(t, int64(1), dp.IntValue()) + attrVal, ok := dp.Attributes().Get("splunk.host") + assert.True(t, ok) + assert.EqualValues(t, "splunk.host-val", attrVal.Str()) + attrVal, ok = dp.Attributes().Get("splunk.searchartifacts.cache.type") + assert.True(t, ok) + assert.EqualValues(t, "splunk.searchartifacts.cache.type-val", attrVal.Str()) case "splunk.server.searchartifacts.savedsearches": assert.False(t, validatedMetrics["splunk.server.searchartifacts.savedsearches"], "Found a duplicate in the metrics slice: splunk.server.searchartifacts.savedsearches") validatedMetrics["splunk.server.searchartifacts.savedsearches"] = true assert.Equal(t, pmetric.MetricTypeGauge, ms.At(i).Type()) assert.Equal(t, 1, ms.At(i).Gauge().DataPoints().Len()) - assert.Equal(t, "Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of scheduled search artifacts, how many different saved-searches they belong to. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.", ms.At(i).Description()) + assert.Equal(t, "Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of scheduled search artifacts, how many different saved-searches they belong to. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.", ms.At(i).Description()) assert.Equal(t, "{search_artifacts}", ms.At(i).Unit()) dp := ms.At(i).Gauge().DataPoints().At(0) assert.Equal(t, start, dp.StartTimestamp()) @@ -777,7 +816,7 @@ func TestMetricsBuilder(t *testing.T) { validatedMetrics["splunk.server.searchartifacts.scheduled"] = true assert.Equal(t, pmetric.MetricTypeGauge, ms.At(i).Type()) assert.Equal(t, 1, ms.At(i).Gauge().DataPoints().Len()) - assert.Equal(t, "Gauge tracking number of scheduled search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head.", ms.At(i).Description()) + assert.Equal(t, "Gauge tracking number of scheduled search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+.", ms.At(i).Description()) assert.Equal(t, "{search_artifacts}", ms.At(i).Unit()) dp := ms.At(i).Gauge().DataPoints().At(0) assert.Equal(t, start, dp.StartTimestamp()) diff --git a/receiver/splunkenterprisereceiver/internal/metadata/testdata/config.yaml b/receiver/splunkenterprisereceiver/internal/metadata/testdata/config.yaml index 449cd89b2255..90380c4d00e2 100644 --- a/receiver/splunkenterprisereceiver/internal/metadata/testdata/config.yaml +++ b/receiver/splunkenterprisereceiver/internal/metadata/testdata/config.yaml @@ -71,6 +71,10 @@ all_set: enabled: true splunk.server.searchartifacts.invalid: enabled: true + splunk.server.searchartifacts.job.cache.count: + enabled: true + splunk.server.searchartifacts.job.cache.size: + enabled: true splunk.server.searchartifacts.savedsearches: enabled: true splunk.server.searchartifacts.scheduled: @@ -149,6 +153,10 @@ none_set: enabled: false splunk.server.searchartifacts.invalid: enabled: false + splunk.server.searchartifacts.job.cache.count: + enabled: false + splunk.server.searchartifacts.job.cache.size: + enabled: false splunk.server.searchartifacts.savedsearches: enabled: false splunk.server.searchartifacts.scheduled: diff --git a/receiver/splunkenterprisereceiver/metadata.yaml b/receiver/splunkenterprisereceiver/metadata.yaml index e6329f500e0d..979c8cfe84d1 100644 --- a/receiver/splunkenterprisereceiver/metadata.yaml +++ b/receiver/splunkenterprisereceiver/metadata.yaml @@ -36,6 +36,9 @@ attributes: splunk.kvstore.storage.engine: description: The backend storage used by the KV store. type: string + splunk.searchartifacts.cache.type: + description: The search artifacts cache type. + type: string metrics: splunk.license.index.usage: @@ -272,7 +275,7 @@ metrics: #'services/server/status/dispatch-artifacts' splunk.server.searchartifacts.adhoc: enabled: false - description: Gauge tracking number of ad hoc search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. + description: Gauge tracking number of ad hoc search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. unit: "{search_artifacts}" gauge: monotonic: false @@ -281,7 +284,7 @@ metrics: attributes: [splunk.host] splunk.server.searchartifacts.scheduled: enabled: false - description: Gauge tracking number of scheduled search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. + description: Gauge tracking number of scheduled search artifacts currently on disk. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. unit: "{search_artifacts}" gauge: monotonic: false @@ -290,7 +293,7 @@ metrics: attributes: [splunk.host] splunk.server.searchartifacts.completed: enabled: false - description: Gauge tracking number of artifacts currently on disk that belong to finished searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. + description: Gauge tracking number of artifacts currently on disk that belong to finished searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. unit: "{search_artifacts}" gauge: monotonic: false @@ -299,7 +302,7 @@ metrics: attributes: [splunk.host] splunk.server.searchartifacts.incomplete: enabled: false - description: Gauge tracking number of artifacts currently on disk that belong to unfinished/running searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. + description: Gauge tracking number of artifacts currently on disk that belong to unfinished/running searches. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. unit: "{search_artifacts}" gauge: monotonic: false @@ -308,7 +311,7 @@ metrics: attributes: [splunk.host] splunk.server.searchartifacts.invalid: enabled: false - description: Gauge tracking number of artifacts currently on disk that are not in a valid state, such as missing info.csv file, etc. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. + description: Gauge tracking number of artifacts currently on disk that are not in a valid state, such as missing info.csv file, etc. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. unit: "{search_artifacts}" gauge: monotonic: false @@ -317,7 +320,25 @@ metrics: attributes: [splunk.host] splunk.server.searchartifacts.savedsearches: enabled: false - description: Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of scheduled search artifacts, how many different saved-searches they belong to. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. + description: Gauge tracking, for the `splunk.server.searchartifacts.scheduled` number of scheduled search artifacts, how many different saved-searches they belong to. Note:* Must be pointed at specific Search Head endpoint and gathers metrics from only that Search Head. Available in builds 9.1.2312.207+ and 9.3.x+. + unit: "{search_artifacts}" + gauge: + monotonic: false + aggregation_temporality: cumulative + value_type: int + attributes: [splunk.host] + splunk.server.searchartifacts.job.cache.size: + enabled: false + description: Gauge tracking, in megabytes, memory used to cache job status and job info of all search artifacts, available in builds 9.1.2312.207+ and 9.3.x+. + unit: "{mb}" + gauge: + monotonic: false + aggregation_temporality: cumulative + value_type: int + attributes: [splunk.host, splunk.searchartifacts.cache.type] + splunk.server.searchartifacts.job.cache.count: + enabled: false + description: Gauge tracking number search artifacts metadata stored in memory, available in builds 9.1.2312.207+ and 9.3.x+. unit: "{search_artifacts}" gauge: monotonic: false diff --git a/receiver/splunkenterprisereceiver/scraper.go b/receiver/splunkenterprisereceiver/scraper.go index 7d55727e71e4..837f98b40785 100644 --- a/receiver/splunkenterprisereceiver/scraper.go +++ b/receiver/splunkenterprisereceiver/scraper.go @@ -1666,7 +1666,7 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T for _, f := range da.Entries { - if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsAdhoc.Enabled { + if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsAdhoc.Enabled { adhocCount, err := strconv.ParseInt(f.Content.AdhocCount, 10, 64) if err != nil { errs <- err @@ -1674,7 +1674,7 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T s.mb.RecordSplunkServerSearchartifactsAdhocDataPoint(now, adhocCount, s.conf.SHEndpoint.Endpoint) } - if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsScheduled.Enabled { + if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsScheduled.Enabled { scheduledCount, err := strconv.ParseInt(f.Content.ScheduledCount, 10, 64) if err != nil { errs <- err @@ -1682,7 +1682,7 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T s.mb.RecordSplunkServerSearchartifactsScheduledDataPoint(now, scheduledCount, s.conf.SHEndpoint.Endpoint) } - if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsCompleted.Enabled { + if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsCompleted.Enabled { completedCount, err := strconv.ParseInt(f.Content.CompletedCount, 10, 64) if err != nil { errs <- err @@ -1690,7 +1690,7 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T s.mb.RecordSplunkServerSearchartifactsCompletedDataPoint(now, completedCount, s.conf.SHEndpoint.Endpoint) } - if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsIncomplete.Enabled { + if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsIncomplete.Enabled { incompleCount, err := strconv.ParseInt(f.Content.IncompleCount, 10, 64) if err != nil { errs <- err @@ -1698,7 +1698,7 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T s.mb.RecordSplunkServerSearchartifactsIncompleteDataPoint(now, incompleCount, s.conf.SHEndpoint.Endpoint) } - if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsInvalid.Enabled { + if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsInvalid.Enabled { invalidCount, err := strconv.ParseInt(f.Content.InvalidCount, 10, 64) if err != nil { errs <- err @@ -1706,12 +1706,34 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T s.mb.RecordSplunkServerSearchartifactsInvalidDataPoint(now, invalidCount, s.conf.SHEndpoint.Endpoint) } - if !s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsSavedsearches.Enabled { + if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsSavedsearches.Enabled { savedSearchesCount, err := strconv.ParseInt(f.Content.SsCount, 10, 64) if err != nil { errs <- err } s.mb.RecordSplunkServerSearchartifactsSavedsearchesDataPoint(now, savedSearchesCount, s.conf.SHEndpoint.Endpoint) } + + if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsJobCacheSize.Enabled { + infoCacheSize, err := strconv.ParseInt(f.Content.InfoCacheSize, 10, 64) + if err != nil { + errs <- err + } + statusCacheSize, err := strconv.ParseInt(f.Content.StatusCacheSize, 10, 64) + if err != nil { + errs <- err + } + s.mb.RecordSplunkServerSearchartifactsJobCacheSizeDataPoint(now, infoCacheSize, s.conf.SHEndpoint.Endpoint, "info") + s.mb.RecordSplunkServerSearchartifactsJobCacheSizeDataPoint(now, statusCacheSize, s.conf.SHEndpoint.Endpoint, "status") + } + + if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsJobCacheCount.Enabled { + cacheTotalEntries, err := strconv.ParseInt(f.Content.CacheTotalEntries, 10, 64) + if err != nil { + errs <- err + } + s.mb.RecordSplunkServerSearchartifactsJobCacheCountDataPoint(now, cacheTotalEntries, s.conf.SHEndpoint.Endpoint) + } + } } diff --git a/receiver/splunkenterprisereceiver/search_result.go b/receiver/splunkenterprisereceiver/search_result.go index 69212c4de08d..a3d1c8dfbeee 100644 --- a/receiver/splunkenterprisereceiver/search_result.go +++ b/receiver/splunkenterprisereceiver/search_result.go @@ -146,10 +146,13 @@ type DispatchArtifactEntry struct { } type DispatchArtifactContent struct { - AdhocCount string `json:"adhoc_count"` - ScheduledCount string `json:"scheduled_count"` - SsCount string `json:"ss_count"` - CompletedCount string `json:"completed_count"` - IncompleCount string `json:"incomple_count"` - InvalidCount string `json:"invalid_count"` + AdhocCount string `json:"adhoc_count"` + ScheduledCount string `json:"scheduled_count"` + SsCount string `json:"ss_count"` + CompletedCount string `json:"completed_count"` + IncompleCount string `json:"incomple_count"` + InvalidCount string `json:"invalid_count"` + InfoCacheSize string `json:"cached_job_status_info_csv_size_mb"` + StatusCacheSize string `json:"cached_job_status_status_csv_size_mb"` + CacheTotalEntries string `json:"cached_job_status_total_entries"` } From e3fcaf067bf06ad05f3fc4b2fe1d1510f8337659 Mon Sep 17 00:00:00 2001 From: Michael Burt Date: Mon, 4 Nov 2024 16:18:36 -0700 Subject: [PATCH 2/5] [receiver/splunkenterprise] Adding Search Artifact Cache Metrics --- ...erprisereceiver-search-artifact-cache.yaml | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .chloggen/splunkenterprisereceiver-search-artifact-cache.yaml diff --git a/.chloggen/splunkenterprisereceiver-search-artifact-cache.yaml b/.chloggen/splunkenterprisereceiver-search-artifact-cache.yaml new file mode 100644 index 000000000000..dcb1f1d13124 --- /dev/null +++ b/.chloggen/splunkenterprisereceiver-search-artifact-cache.yaml @@ -0,0 +1,27 @@ +# Use this changelog template to create an entry for release notes. + +# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix' +change_type: enhancement + +# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver) +component: splunkenterprisereceiver + +# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`). +note: Add new metrics for Splunk Enterprise dispatch artifacts caches + +# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists. +issues: [] + +# (Optional) One or more lines of additional information to render under the primary note. +# These lines will be padded with 2 spaces and then inserted directly into the document. +# Use pipe (|) for multiline entries. +subtext: + +# If your change doesn't affect end users or the exported elements of any package, +# you should instead start your pull request title with [chore] or use the "Skip Changelog" label. +# Optional: The change log or logs in which this entry should be included. +# e.g. '[user]' or '[user, api]' +# Include 'user' if the change is relevant to end users. +# Include 'api' if there is a change to a library API. +# Default: '[user]' +change_logs: [user] From b51a9423dc42e7134f218429ebef829e70babc3b Mon Sep 17 00:00:00 2001 From: Michael Burt Date: Mon, 4 Nov 2024 17:42:41 -0700 Subject: [PATCH 3/5] update issue number --- .chloggen/splunkenterprisereceiver-search-artifact-cache.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.chloggen/splunkenterprisereceiver-search-artifact-cache.yaml b/.chloggen/splunkenterprisereceiver-search-artifact-cache.yaml index dcb1f1d13124..0a2935340efe 100644 --- a/.chloggen/splunkenterprisereceiver-search-artifact-cache.yaml +++ b/.chloggen/splunkenterprisereceiver-search-artifact-cache.yaml @@ -10,7 +10,7 @@ component: splunkenterprisereceiver note: Add new metrics for Splunk Enterprise dispatch artifacts caches # Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists. -issues: [] +issues: [36181] # (Optional) One or more lines of additional information to render under the primary note. # These lines will be padded with 2 spaces and then inserted directly into the document. From 5350e18b903860e2ed03d9615360e8d8c39f3093 Mon Sep 17 00:00:00 2001 From: Michael Burt Date: Wed, 6 Nov 2024 21:45:16 -0700 Subject: [PATCH 4/5] [receiver/splunkenterprise] Adding Search Artifact Cache Metrics --- receiver/splunkenterprisereceiver/scraper.go | 6 +++--- .../splunkenterprisereceiver/search_result.go | 18 +++++++++--------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/receiver/splunkenterprisereceiver/scraper.go b/receiver/splunkenterprisereceiver/scraper.go index 837f98b40785..4e78e709908a 100644 --- a/receiver/splunkenterprisereceiver/scraper.go +++ b/receiver/splunkenterprisereceiver/scraper.go @@ -1691,11 +1691,11 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T } if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsIncomplete.Enabled { - incompleCount, err := strconv.ParseInt(f.Content.IncompleCount, 10, 64) + incompleteCount, err := strconv.ParseInt(f.Content.IncompleteCount, 10, 64) if err != nil { errs <- err } - s.mb.RecordSplunkServerSearchartifactsIncompleteDataPoint(now, incompleCount, s.conf.SHEndpoint.Endpoint) + s.mb.RecordSplunkServerSearchartifactsIncompleteDataPoint(now, incompleteCount, s.conf.SHEndpoint.Endpoint) } if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsInvalid.Enabled { @@ -1707,7 +1707,7 @@ func (s *splunkScraper) scrapeSearchArtifacts(ctx context.Context, now pcommon.T } if s.conf.MetricsBuilderConfig.Metrics.SplunkServerSearchartifactsSavedsearches.Enabled { - savedSearchesCount, err := strconv.ParseInt(f.Content.SsCount, 10, 64) + savedSearchesCount, err := strconv.ParseInt(f.Content.SavedSearchesCount, 10, 64) if err != nil { errs <- err } diff --git a/receiver/splunkenterprisereceiver/search_result.go b/receiver/splunkenterprisereceiver/search_result.go index a3d1c8dfbeee..bd6c4318b016 100644 --- a/receiver/splunkenterprisereceiver/search_result.go +++ b/receiver/splunkenterprisereceiver/search_result.go @@ -146,13 +146,13 @@ type DispatchArtifactEntry struct { } type DispatchArtifactContent struct { - AdhocCount string `json:"adhoc_count"` - ScheduledCount string `json:"scheduled_count"` - SsCount string `json:"ss_count"` - CompletedCount string `json:"completed_count"` - IncompleCount string `json:"incomple_count"` - InvalidCount string `json:"invalid_count"` - InfoCacheSize string `json:"cached_job_status_info_csv_size_mb"` - StatusCacheSize string `json:"cached_job_status_status_csv_size_mb"` - CacheTotalEntries string `json:"cached_job_status_total_entries"` + AdhocCount string `json:"adhoc_count"` + ScheduledCount string `json:"scheduled_count"` + SavedSearchesCount string `json:"ss_count"` + CompletedCount string `json:"completed_count"` + IncompleteCount string `json:"incomple_count"` + InvalidCount string `json:"invalid_count"` + InfoCacheSize string `json:"cached_job_status_info_csv_size_mb"` + StatusCacheSize string `json:"cached_job_status_status_csv_size_mb"` + CacheTotalEntries string `json:"cached_job_status_total_entries"` } From 31ad4dfff5121214d03732b1fc033d9c60d5fe2f Mon Sep 17 00:00:00 2001 From: Michael Burt Date: Wed, 6 Nov 2024 21:57:57 -0700 Subject: [PATCH 5/5] [receiver/splunkenterprise] Adding Search Artifact Cache Metrics --- receiver/splunkenterprisereceiver/documentation.md | 6 +++--- receiver/splunkenterprisereceiver/metadata.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/receiver/splunkenterprisereceiver/documentation.md b/receiver/splunkenterprisereceiver/documentation.md index 81317c1395af..dfc2559816a4 100644 --- a/receiver/splunkenterprisereceiver/documentation.md +++ b/receiver/splunkenterprisereceiver/documentation.md @@ -444,8 +444,8 @@ This is the overall status of the kvstore for the given deployment. | Name | Description | Values | | ---- | ----------- | ------ | -| splunk.kvstore.storage.engine | The backend storage used by the KV store. | Any Str | -| splunk.kvstore.external | Value denoting if the KV store is using an external service. | Any Str | +| splunk.kvstore.storage.engine | The backend storage used by the KV store | Any Str | +| splunk.kvstore.external | Value denoting if the KV store is using an external service | Any Str | | splunk.kvstore.status.value | The string value of the status returned when reporting on KV store using the introspection endpoint | Any Str | ### splunk.server.introspection.queues.current @@ -559,7 +559,7 @@ Gauge tracking, in megabytes, memory used to cache job status and job info of al | Name | Description | Values | | ---- | ----------- | ------ | | splunk.host | The name of the splunk host | Any Str | -| splunk.searchartifacts.cache.type | The search artifacts cache type. | Any Str | +| splunk.searchartifacts.cache.type | The search artifacts cache type | Any Str | ### splunk.server.searchartifacts.savedsearches diff --git a/receiver/splunkenterprisereceiver/metadata.yaml b/receiver/splunkenterprisereceiver/metadata.yaml index 979c8cfe84d1..6ead19fbe79b 100644 --- a/receiver/splunkenterprisereceiver/metadata.yaml +++ b/receiver/splunkenterprisereceiver/metadata.yaml @@ -31,13 +31,13 @@ attributes: description: The string value of the status returned when reporting on KV store using the introspection endpoint type: string splunk.kvstore.external: - description: Value denoting if the KV store is using an external service. + description: Value denoting if the KV store is using an external service type: string splunk.kvstore.storage.engine: - description: The backend storage used by the KV store. + description: The backend storage used by the KV store type: string splunk.searchartifacts.cache.type: - description: The search artifacts cache type. + description: The search artifacts cache type type: string metrics: