I have installed and configured collectd on 3 servers so far, and on 2 of them it works fine. These servers show up in the Splunk App for Infrastructure correctly; I can view all metrics as expected. The third server is throwing two errors consistently, as shown below.
Oct 16 10:37:54 collectd[13731]: plugin_read_thread: read-function of the `flush/write_splunk' plugin took 90.018 seconds, which is above its read interval (90.000 seconds). You might want to adjust the `Interval' or `ReadThreads' settings.
Oct 16 10:38:54 collectd[13731]: write splunk plugin: curl_easy_perform failed to connect to :8088 with status 35: SSL connect error
The collectd.conf is literally copy-pasted between all three servers, and only the `Hostname` option has been updated.
The HEC VIP is a load balancer pointing to all 4 indexers in our indexer cluster, if that makes a difference.
↧