Arista LANZ and Splunk Integration

Input and output integration overview

The Arista LANZ plugin is designed for reading latency and congestion metrics from Arista LANZ, helping users monitor their network performance effectively.

This output plugin facilitates direct streaming of Telegraf collected metrics into Splunk via the HTTP Event Collector, enabling easy integration with Splunk’s powerful analytics platform.

Integration details

Arista LANZ

This plugin provides a consumer for use with Arista Networks’ Latency Analyzer (LANZ). Metrics are read from a stream of data via TCP through port 50001 on the switches management IP. The data is in Protobuffers format, allowing for efficient transportation and parsing of data. LANZ is utilized to monitor network latency and congestion in real-time, which is vital for maintaining optimal performance in networking environments. The underlying technology, Arista’s latency analysis, provides insights into various network operations and infrastructure behaviors, making it a crucial tool for network engineering and management.

Splunk

Use Telegraf to easily collect and aggregate metrics from many different sources and send them to Splunk. Utilizing the HTTP output plugin combined with the specialized Splunk metrics serializer, this configuration ensures efficient data ingestion into Splunk’s metrics indexes. The HEC is an advanced mechanism provided by Splunk designed to reliably collect data at scale via HTTP or HTTPS, providing critical capabilities for security, monitoring, and analytics workloads. Telegraf’s integration with Splunk HEC streamlines operations by leveraging standard HTTP protocols, built-in authentication, and structured data serialization, optimizing metrics ingestion and enabling immediate actionable insights.

Configuration

Arista LANZ

[[inputs.lanz]]
  ## URL to Arista LANZ endpoint
  servers = [
    "tcp://switch1.int.example.com:50001",
    "tcp://switch2.int.example.com:50001",
  ]

Splunk

[[outputs.http]]
  ## Splunk HTTP Event Collector endpoint
  url = "https://splunk.example.com:8088/services/collector"

  ## HTTP method to use
  method = "POST"

  ## Splunk authentication token
  headers = {"Authorization" = "Splunk YOUR_SPLUNK_HEC_TOKEN"}

  ## Serializer for formatting metrics specifically for Splunk
  data_format = "splunkmetric"

  ## Optional parameters
  # timeout = "5s"
  # insecure_skip_verify = false
  # tls_ca = "/path/to/ca.pem"
  # tls_cert = "/path/to/cert.pem"
  # tls_key = "/path/to/key.pem"

Input and output integration examples

Arista LANZ

1. Real-Time Latency Monitoring: This plugin can be used to set up a monitoring dashboard that tracks real-time latency metrics across multiple interfaces. By gathering and visualizing this data, network admins can swiftly identify and rectify latency issues before they impact service quality. The challenge lies in efficiently handling the influx of metrics from various sources without overwhelming the infrastructure or incurring excessive processing delays.

2. Congestion Analysis for Traffic Engineering: Users can leverage the LANZ plugin to analyze congestion records, enabling the optimization of network traffic flows. By applying historical pattern recognition to the metrics collected, IT teams can make informed decisions on traffic management strategies, thus improving overall network efficiency. This requires implementing robust data storage and analysis capabilities to derive actionable insights from the raw metrics.

3. Integration with Alerting Systems: Integrate the metrics from this plugin with alerting systems to automatically notify network engineers of any significant changes in latency or congestion. By setting thresholds based on historical data trends, this use case enhances proactive incident management, allowing teams to address potential issues proactively. The technical challenge here is establishing the right balance in threshold settings to minimize false positives while ensuring genuine issues are flagged promptly.

4. Network Optimization Reports: Utilize the metrics gathered through the LANZ plugin to generate periodic reports that detail network performance, latency trends, and congestion events. These reports can help stakeholders understand network health over time and guide infrastructure investments. The challenge involves structuring and formatting the output data to make it comprehensible and actionable for various audiences.

Splunk

1. Real-Time Security Analytics: Utilize this plugin to stream security-related metrics from various applications into Splunk in real-time. Organizations can detect threats instantly by correlating data streams across systems, significantly reducing detection and response times.

2. Multi-Cloud Infrastructure Monitoring: Integrate Telegraf to consolidate metrics from multi-cloud environments directly into Splunk, enabling comprehensive visibility and operational intelligence. This unified monitoring allows teams to detect performance issues quickly and streamline cloud resource management.

3. Dynamic Capacity Planning: Deploy the plugin to continuously push resource metrics from container orchestration platforms (like Kubernetes) into Splunk. Leveraging Splunk’s analytics capabilities, teams can automate predictive scaling and resource allocation, avoiding resource bottlenecks and minimizing costs.

4. Automated Incident Response Workflows: Combine this plugin with Splunk’s alerting system to create automated incident response workflows. Metrics collected by Telegraf trigger real-time alerts and automated remediation scripts, ensuring rapid resolution and maintaining high system availability.

Feedback

Thank you for being part of our community! If you have any general feedback or found any bugs on these pages, we welcome and encourage your input. Please submit your feedback in the InfluxDB community Slack.