Splunk_health plugin not working in 1.6.0p11

Troubleshooting
,
#1

CMK version:
1.6.0p11
OS version:
Linux
Error message:
File “./splunk_health”, line 42, in
“red”: 2,
NameError: name ‘factory_settings’ is not defined

Output of “cmk --debug -vvn hostname”: (If it is a problem with checks or plugins)
WARN - [agent] Version: 1.6.0p11, OS: linux, Missing agent sections: splunk_heal th(!)

Hello! First topic creating here.
I’m trying to incorporate splunk monitoring to check_mk by using the plugin splunk_health which was found in omd/sites/[sitename]/share/check_mk/checks.

Link to plugin: Splunk: Health

This was later copied to /omd/sites/[sitename]/local/share/check_mk/agents/plugins and /omd/sites/[sitename]/share/check_mk/agents/plugins. This made it possible to download the plugin from monitoring agents-agent files from the GUI.
So the plugin was copied to the site and to the explicit host under /usr/lib/check_mk_agent/plugins and made executable. However when im trying to execute the file the error appears: File “./splunk_health”, line 42, in
“red”: 2,
NameError: name ‘factory_settings’ is not defined

In check mk the service is “pending” and does not retrieve any data.

I’ve tried to find info about this issue, but to no result.

Im therefore wondering if anyone has knowlegde about this issue or if i’m just doing something completely wrong.

I’ve landed on some theories that might cause this to not work:

  • Not possible to copy plugins directly from share/check_mk/checks
  • Missing data to fetch info from splunk_health
  • Fault in splunk_health source code/outdated version

Thank you for any replies :slight_smile:

#2

What you copied and deployed to your host is not an agent plugin but a check plugin. This file does not belong on the host.
You need to configure the Splunk integration with the ruleset “Check state of Splunk” in Datasource programs.

1 Like
#3

Thank you for the reply! :slight_smile:

I’ve looked into this check before, but i was under the impression that this would result in only splunk monitoring with the special agent, and not regular monitoring via the check_mk agent.

based on Splunk Monitoring with Checkmk | Checkmk it seems like it’s not possible to monitor both splunk and regular monitoring, is that correct ? :open_mouth:
Thank you :slight_smile: