topic Re: Technology Inventory (BETA) - Is something missing? in All Apps and Add-ons

Technology Inventory (BETA) - Is something missing?

lycollicott — Mon, 14 Aug 2017 13:29:58 GMT

I installed this 3 days ago, but it doesn't seem to have everything - at least that is my assumption.

The inputs.conf intervals of 86400 seconds never ran at all, but I tested a couple at 60 second intervals and they do run that way.
Tag "virtual" is missing.
The dropdowns never populate.

Re: Technology Inventory (BETA) - Is something missing?

lycollicott — Tue, 15 Aug 2017 14:50:26 GMT

I forgot to mention that before I tested with the 60 second interval, this error displayed in the "Deployed Servers" panel:

Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model 'Compute_Inventory' was not found.

Re: Technology Inventory (BETA) - Is something missing?

sloshburch — Tue, 15 Aug 2017 22:00:26 GMT

Thanks for your interest! The timing is wild! We JUST posted a complete rewrite of the app (or specifically, the Addon). Would you uninstall that old one and give this a shot?
https://splunkbase.splunk.com/app/3032

Re: Technology Inventory (BETA) - Is something missing?

lycollicott — Wed, 16 Aug 2017 15:25:02 GMT

It doesn't seem to have an inputs.conf.

Re: Technology Inventory (BETA) - Is something missing?

sloshburch — Wed, 16 Aug 2017 15:35:43 GMT

That's correct. Did you see the documentation on the splunkbase site? Let me know if you have any questions so I can learn how to improve the documentation to be more clear about data collection.

Re: Technology Inventory (BETA) - Is something missing?

lycollicott — Thu, 17 Aug 2017 01:43:22 GMT

Oh, this works much better and I am excited about its possibilities. I deployed it to Windows servers in one of our domains and tomorrow I will try it on some Linux servers.

Re: Technology Inventory (BETA) - Is something missing?

sloshburch — Thu, 17 Aug 2017 13:32:45 GMT

Oh excellent!

To clarify, you mentioned that you "deployed it" to Windows servers and then will try Linux. Did you see in the Details tab in the Install section:

Install the Splunk Add-on for Technology Inventory on any Search Heads in your environment. The Splunk Add-on for Technology Inventory does not need to be installed to any Forwarders, Indexers, or other non-Searching Splunk instances.

In other words, are you doing Searches directly from the web ui of those Windows and Linux servers you mentioned? If not, remember that this app only needs to live on the Search Heads and not on the endpoints. Conversely, both the Splunk Add-on for Unix and Linux and Splunk Add-on for Microsoft Windows need to be installed on the endpoints to do data collection...but not the Splunk Add-on for Technology Inventory.

I hope that clarifies.

Re: Technology Inventory (BETA) - Is something missing?

lycollicott — Thu, 17 Aug 2017 14:38:10 GMT

By deployed, I meant that I enabled those inputs and reloaded them from our deployment server.

Re: Technology Inventory (BETA) - Is something missing?

sloshburch — Thu, 17 Aug 2017 17:15:22 GMT

Oh cool! I'm surprised they weren't already enabled for operational stuff. Glad to be the one to introduce you to them!