topic Re: Splunk App and Add-on for Unix and Linux –– add-on specific fields are not being extracted, which is breaking the dashboards in All Apps and Add-ons

Splunk App and Add-on for Unix and Linux –– add-on specific fields are not being extracted, which is breaking the dashboards

chris_jepeway — Tue, 26 Sep 2017 17:32:36 GMT

I've got the Splunk Add-on for Unix and Linux installed on my index master and across my 3 indexers via a cluster bundle.

In the App for Unix & Linux running on my search head, I can see results from all 4 hosts, text like the output from cpu.sh and ps.sh.

But none of the add-on specific fields, e.g., pctCPU from top.sh, are being extracted, which of course breaks many of the associated dashboards.

Any help on getting the app & add-ons working, and in particular, fixing field extraction, across the cluster would be very much appreciated.

Re: Splunk App and Add-on for Unix and Linux –– add-on specific fields are not being extracted, which is breaking the dashboards

chris_jepeway — Tue, 26 Sep 2017 21:52:53 GMT

And, it's worth pointing out that I'm trying to work through installing the app by using tar to extract the tarball into $SPLUNK_HOME/etc/{apps,master-apps} myself, and then copying configs out of default/ and into /local. I've set up inputs.conf (change to disabled = 0) and indexes.conf (add repFactor = auto)...but it seems I'm missing some setup.

I'll try an "install from file" and see what I get.

Re: Splunk App and Add-on for Unix and Linux –– add-on specific fields are not being extracted, which is breaking the dashboards

harsmarvania57 — Tue, 29 Sep 2020 15:57:40 GMT

Hi @chris.jepeway,

To achieve this field extraction on search head you need to install Splunk Add-on for Unix and Linux (Splunk_TA_nix) on search head because field extraction (props.conf) and field transformation (transforms.conf) is available in Add-on to break those fields not in App.

Thanks,
Harshil

Re: Splunk App and Add-on for Unix and Linux –– add-on specific fields are not being extracted, which is breaking the dashboards

chris_jepeway — Wed, 27 Sep 2017 21:48:13 GMT

Ah, perfect, it works!

Um, what did I miss when I didn't understand I needed the TA as well as the app? Is that the usual case, e.g.? That I'll need to install a TA as well as an app, whenever both exist, on search heads? Or is this a special case for the Nix app & TA?

Re: Splunk App and Add-on for Unix and Linux –– add-on specific fields are not being extracted, which is breaking the dashboards

harsmarvania57 — Thu, 28 Sep 2017 04:13:22 GMT

This depends on case by case, for some of the application you require TA and app both on search heads and for some of the application only app is require.