Splunk Platform
ExtensionSplunk Platform
A Steadybit integration for the Splunk Cloud Platform and Splunk Enterprise.ExtensionSplunk Platform
ExtensionSplunk Platform
A Steadybit integration for the Splunk Cloud Platform and Splunk Enterprise.Extension
Go back to listYouTube content is not loaded by default for privacy reasons.
Introduction to the Splunk Cloud Platform and Splunk Enterprise Extension
The Steadybit Splunk Platform Extension bridges the world of Steadybit and Splunk Cloud Platform and Splunk Enterprise.
The extension discovers Splunk Cloud Platform and Splunk Enterprise Alerts and allows to check their state during experiments.
Integration and Functionality
Integration of Splunk Cloud Platform and Splunk Enterprise into Steadybit works via the Splunk REST API. The extension requires a Splunk Access Token to use the REST API.
There may be extra steps to access Splunk Cloud Platform. Details are available on the Access requirements and limitations for the Splunk Cloud Platform REST API documentation page.
Integration in Steadybit
With the Alert Check you can integrate Splunk Alerts into experiments and verify that a Splunk Alert was fired due to other actions in your experiment.
Installation and Setup
To integrate the Splunk Platform extension into your environment, follow our setup guide.
Splunk platform alerts when a Kubernetes pod is in crash loop
Verify that Splunk platform is firing an alert when pods are not ready to accept traffic for a certain time.
Motivation
Kubernetes features a readiness probe to determine whether your pod is ready to accept traffic. If it isn't becoming ready, Kubernetes tries to solve it by restarting the underlying container and hoping to achieve its readiness eventually. If this isn't working, Kubernetes will eventually back off to restart the container, and the Kubernetes resource remains non-functional.
Structure
First, check that the Splunk platform alert responsible for tracking non-ready containers is not in a firing state. As soon as one of the containers is crash looping, caused by the crash loop attack, the Splunk platform alert should fire and escalate it to your on-call team.
Solution Sketch
- Kubernetes liveness, readiness, and startup probes
