Ruby on Rails
Overview
Details
Thanks to John Berry (Lumos Labs) and Simeon Yep (Splunk) for their invaluable assistance with this app.
Features
Two Dashboards and six saved searches/reports:
- Rails Request Overview provides charts and tables that show requests over time, average, min, and max request times by Controller#action, and breakdowns by render and db time
- Rails stats show basic stats around top action, method, and clients
Permissions
By default, permissions are set at the app level - users in the 'admin' role have read and write permissions.
You can change the app level permissions by navigating to Manager >> Apps >> Rails "Permissions". Use caution!
Field Extractions
To ensure that field extractions are working properly, you will need to ensure that the correct source type is linked to the field extractions.
By default, the app will already work if your rails events are coming in under the source type "rails".
Otherwise, you should copy $SPLUNK_HOME/etc/apps/rails/default/props.conf to $SPLUNK_HOME/etc/apps/rails/local/props.conf, and change the existing rails stanza to the source type that contains your Rails production data.
For example, to set the field extractions to work with the source type foobar, $SPLUNK_HOME/etc/apps/rails/local/props.conf should look as follows:
[foobar]
#field extractions
EXTRACT-rails-db = ((ActiveRecord:)|(DB:))\s(?<db_time>[\d.]*)
EXTRACT-rails-render = ((Views:)|(View:)|(Rendering:))\s(?<render_time>[\d.]*)
EXTRACT-rails-parameters = Completed.*in\s(?<request_time>[\d.]*)(ms)?(\s\((?<req_per_sec>\d*)\sreqs/sec)?
EXTRACT-rails-processing = Processing(\s)(?<controller>\S+)#(?<action>\S+)(\s\(for\s(?<client>[\d.]*).*\)\s\[(?<method>\S+)\])?
EXTRACT-rails-render-template = Rendering\s(?!template\swithin)(?<render_template>\S*)
EXTRACT-rails-response = Completed in.* \| (?P<response_code>\d{3})\s(?<response_msg>\S+)\s\[(?<response_uri>\S*)\]
EXTRACT-rails-sessionid = Session\sID:\s(?<session_id>\S*)
REPORT-ruby_on_rails = rails_delim, rails_sub_call_1, rails_sub_call_2
#timestamp recognition
TIME_PREFIX = (for [\d\.]+ at\s)
TIME_FORMAT = %Y-%m-%d %H:%M:%S
#line breaking for multiline ruby logs (groups events together in transactional view)
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = Processing
A diagram of the fields that get extracted for common Ruby log formats is located under the Views menu in the app.
Sample Data
Sample data to test this app is available at $SPLUNK_HOME/etc/apps/rails/logs/
Questions?
If you have problem or suggestions to improve the app please post to answers.splunk.com using the link on this page.
Release Notes
Version 1.01
Changed naming