Arduino, Meet Splunk

Diy IoT is incredibly fun, and the barrier to entry is pretty low. There are wifi connected arduino boards out there to be had for $10–$20. Much of the time these boards will become packed with sensors and able to monitor their surroundings easily. Examples include temperature, humidity, barmoetric pressure, light and motion. https://www.adafruit.com/category/35 Building further sensor gateways and gathering that data from the ‘dunios quickly shoots up the learning curve and gets developers quickly frustrated trying to gather from boards and process the data. Using a couple libraries one can quickly and simply get this data pushed into a personal splunk instance. This is done through a simple web post to the Splunk Http Event Collector or “hec.” From there the sky is the limit.

First things first what is an arduino? https://www.arduino.cc/ Arduinos are an entire clarification of microcontoller boards. Some are configured bare bones and others are esp8266 chips with extra memory space and breakouts. The boards used in this explanation are Adafruit “Huzzah” 8266 breakouts. https://www.adafruit.com/product/2471 These are used because of cost of materials, an arduino Uno board is the entry level board for $20. It is a bare microcontroller which would then require a second “shield” in order to bundle a wifi controller onto it. It is much easier to get a simple cheap huzzah. Adafruit has a great community of tutorials and getting started guides to get the Arduino IDE downloaded and configured, and then installing the proper libraries to support the huzzah board. Those libraries are then leveraged for the http and wifi clients. Take a look, get the IDE configured and the boards added here. https://learn.adafruit.com/add-boards-arduino-v164?view=all

Before diving into the Arduino “sketch code”, it should be understood the kind of code we are going to see. Arduinos are pretty much a friendlier “C.” Much of the strongly typed language is there, however String is available and the entire compiling and upload process is done through a nice gui. It can also be done through makefiles and the like but the debugger is at least a little bit better in the Arduino IDE. It’s recommended to start there. A result of the C roots is that working with http requests is going to be a little less than user friendly, but not terrible. The http headers will need to be added and then the content length summed up and finally the entire message bundled up before submitting the http post request. While this isn't the end of the world if someone is not familiar with how http works it could be confusing. Don’t worry, take some time read the code, it will all make sense.

Just over 100 lines of code, hopefully that was’t too bad. The majority of the work is broken out into a couple functions. The Loop() function is constantly running because that is how arduino works. Setup() is run once on boot. Then everything else is only run when called. The Loop() gathers up some dummy data and passes it the splunkpost() . If there was a more elaborate data gather needed it could be easily called from the loop and then returned to be sent on to splunkpost(). Splunk post receives all the parameters that were configured at the beginning for the Splunk server, HEC, and some metadata. There is a gotcha in that the http collector is hard coded in the firmware, there are more elegant and configurable ways to do this, however for this purpose it is fine. it should be noted that a rebuild and reflash would be needed if the HEC were to change.

Thats all folks! An arduino connected to wifi network and then sending that data directly into Splunk via HEC. All without the need for anything else, no data gateways no serial bit banging between shields to push the sensors to the wifi board. Just sensor data from a DiY arduino going into the robust awesomeness that is Splunk. From Splunk all the analytics number crunching and alerting can be done. Hopefully this was descriptive enough to the wheels turning and the data flowing.

Links:

Arduino - Home_Open-source electronic prototyping platform enabling users to create interactive electronic objects._www.arduino.cc

Adafruit HUZZAH ESP8266 Breakout_Adafruit Industries, Unique & fun DIY electronics and kits Adafruit HUZZAH ESP8266 Breakout ID: 2471 - Add Internet…_www.adafruit.com

Overview | Adding Third Party Boards to the Arduino v1.6.4+ IDE | Adafruit Learning System_Version 1.6.4 of the Arduino IDE introduced official support for adding third party boards (like the Adafruit Flora and…_learn.adafruit.com

Overview | Adafruit HUZZAH ESP8266 breakout | Adafruit Learning System_The HUZZAH ESP8266 breakout is what we designed to make working with this chip super easy and a lot of fun. We took a…_learn.adafruit.com

Sensors : Adafruit Industries, Unique & fun DIY electronics and kits_Adafruit Industries, Unique & fun DIY electronics and kits : Sensors - Tools Gift Certificates Arduino Cables…_www.adafruit.com

About the Splunk HTTP Event Collector - Splunk Documentation_The token admin can be the Splunk Enterprise or self-service Splunk Cloud admin, or a different person who does not…_docs.splunk.com