topic Re: Splunk App for Unix and Linux configuration in All Apps and Add-ons

Splunk App for Unix and Linux configuration

swdowiarz — Wed, 27 Dec 2017 11:56:24 GMT

I've installed Splunk App for Unix and Linux and Splunk Add-on for Unix and Linux. I want to monitor basic things about my machine as CPU usage, memory etc.
In documentation I've read that for the first install there is no need to do any changes in Settings -> Your Data.

When I want to display home dashboard it shows No results found. Can it be connected with sourcetype in Settings -> your data, because I leave it with default.
I would be grateful for some advice.

Re: Splunk App for Unix and Linux configuration

harsmarvania57 — Wed, 27 Dec 2017 12:22:41 GMT

Hi @swdowiarz,

You need to configure Splunk Add-on for Unix and Linux first which will run different script at certain interval (You can configure this) to monitor CPU, Memory, Disk Usage etc. Please refer this documentation to configure Splunk Add-on for Unix and Linux so that it will send data to Indexers and after that you can search data from Search head.

I hope this helps.

Thanks,
Harshil

Re: Splunk App for Unix and Linux configuration

swdowiarz — Wed, 27 Dec 2017 13:01:53 GMT

I did configuration for Splunk Add-on for Unix and Linux and all the inputs are enable, but there still nothing to show.

Re: Splunk App for Unix and Linux configuration

harsmarvania57 — Wed, 27 Dec 2017 13:26:02 GMT

Have you installed this add-on on Indexers as well because add-on will send data to os index, so you must have os index on Indexers.

Re: Splunk App for Unix and Linux configuration

swdowiarz — Wed, 27 Dec 2017 13:29:17 GMT

Yes, I did it, when I search index=os there are lot of events but instead of dashboards there is still No results found

Re: Splunk App for Unix and Linux configuration

harsmarvania57 — Wed, 27 Dec 2017 13:44:24 GMT

So based on my understanding, you are not able to see any data in Splunk App for Unix and Linux Dashboard, in that case have you configured Splunk App for Unix and Linux, reference docs http://docs.splunk.com/Documentation/UnixApp/5.2.3/User/First-timeconfiguration and if you go to next pages it will give you idea about different dashboards/pages.

If data is coming from Add-on with default sourcetype then in App for Unix and Linux Settings-> Your Data page you need to click save button.