topic Re: Splunk App for Unix and Linux: Why is the app not showing memory info? in All Apps and Add-ons

Splunk App for Unix and Linux: Why is the app not showing memory info?

ralphw_SAIC — Fri, 25 Nov 2016 13:41:58 GMT

I am trying to get the Splunk App for Unix and Linux to show memory information and it does not show anything. I have verified that vmstats is running and sending information. I can search on sourcetype=vmstat and receive info for the servers.

Any help would be appreciated on how to rectify this issue.

Re: Splunk App for Unix and Linux: Why is the app not showing memory info?

amielke — Fri, 25 Nov 2016 15:03:10 GMT

We had the same problem, in the sourcetype vmstats were data. In the sourcetype cpu or df were no data. Verify that the os sysstat package is installed. After that we had data in both sourcetypes.

Re: Splunk App for Unix and Linux: Why is the app not showing memory info?

mattymo — Mon, 28 Nov 2016 01:29:57 GMT

+1 for making sure sysstat is installed!

Re: Splunk App for Unix and Linux: Why is the app not showing memory info?

ralphw_SAIC — Tue, 29 Nov 2016 12:45:22 GMT

sysstat is installed on the systems. the issue isn't that we are not receiving information for those sourcetypes. we get them when we search for them, we just don't get them in the app for unix/linux even though the sourcetypes are configured in the app.

Re: Splunk App for Unix and Linux: Why is the app not showing memory info?

mattymo — Tue, 29 Nov 2016 14:05:32 GMT

my bad for the quick read of the issue.

if you go into the Splunk for *nix app, and go to settings >> your data >> Memory data

are you set to sourcetype=vmstat?

If so, when you hit the preview button, do any events return?

Perhaps try hitting save on that page again?

Also, can you advise where in the app you are looking? Both on the home page and on the hosts page? What do you see for the hosts page when in table view?

Re: Splunk App for Unix and Linux: Why is the app not showing memory info?

ralphw_SAIC — Wed, 30 Nov 2016 12:49:37 GMT

sourcetype=vmstat and doing a preview I do get the vmstat data.

I am looking at it both from the home page, metrics page, and hosts page. It shows nothing. The hosts page says both memory and disk is unknown and asks if they are enabled, which they are.

Re: Splunk App for Unix and Linux: Why is the app not showing memory info?

macado — Thu, 30 Mar 2017 15:25:13 GMT

I'm running into same issue, any ideas? I see plenty of data if I do sourcetype=vmstat but under dashboard I get unknown - is vmstat.sh enabled?

Re: Splunk App for Unix and Linux: Why is the app not showing memory info?

jiaqya — Wed, 22 Nov 2017 14:07:22 GMT

Ralph, Did you get an solution for this issue . i am kind of facing same issue.. its there in the sourcetypes, but not on home/metrics or hosts...

Re: Splunk App for Unix and Linux: Why is the app not showing memory info?

sufi — Fri, 22 Nov 2019 12:39:45 GMT

Anyone found any solution for this? I am also facing the same issue.