topic Re: SAI - Windows entity does not show up in All Apps and Add-ons

SAI - Windows entity does not show up

peterschloenske — Wed, 30 Sep 2020 05:06:21 GMT

Hi,

in the App for Infrastructure this search returns results for 1x Linux and 1x Windows host. So I assume data is coming in as expected:

| mstats latest(_value) WHERE index=em_metrics metric_name=* BY host, entity_type

However, the windows host does not show up as entity in the investigate tab while the linux host does.

And it is missing here as well:
| inputlookup em_entities

Anyone has an idea what could be wrong here?

Cheers

Re: SAI - Windows entity does not show up

dagarwal_splunk — Wed, 30 Sep 2020 05:06:33 GMT

Increase the "monitoring_calculation_window" for "perfmon" in collectors.conf to something like 300 and restart Splunk

Re: SAI - Windows entity does not show up

peterschloenske — Tue, 21 Apr 2020 08:14:48 GMT

Unfortunately this did not help. I'm still receiving metrics for both hosts, but only the linux host appears in | inputlookup em_entities.

Re: SAI - Windows entity does not show up

dagarwal_splunk — Wed, 30 Sep 2020 05:06:52 GMT

Can you answer some questions:

Do you see Processor.* metrics for your Windows hosts?
For this search on windows host, what is latest timestamp with data? (last data was 1min , 2min or 3min ago when you run the search? 😞 | mstats avg(_value) WHERE metric_name=Processor.%_Idle_Time AND index=em_metrics AND host=mywindows* span=30s
What version of SAI do you have?

Re: SAI - Windows entity does not show up

peterschloenske — Wed, 30 Sep 2020 05:07:16 GMT

There are only Process.* metrics available so far.
The latest timestamp with data for this host is 1min ago.
I have SAI 2.0.3 in use.

Sidenote:
In another environment the similar problem occured and here the increase of "monitoring_calculation_window" did the trick. Could you explain what is exactly done with this value?

Re: SAI - Windows entity does not show up

dagarwal_splunk — Wed, 30 Sep 2020 05:07:36 GMT

You need Processor.* metrics for Windows entity discovery. Are they disabled in your inputs.conf.

monitoring_calculation_window is how many seconds to look in past for the new entity. It was set to 90 sec. If there is some data lag of more than 90 sec, entity won't be discovered. Solution is to increase this number if not working for you.

Re: SAI - Windows entity does not show up

francoisternois — Tue, 28 Apr 2020 10:23:38 GMT

Hello Peter,
Can you share your inputs.conf ?
In my case, I just add _meta = os::Windows
Otherwise, it didn't show up...

Re: SAI - Windows entity does not show up

peterschloenske — Thu, 07 May 2020 11:42:21 GMT

Processor.* are not disabled in the inputs.conf
Maybe something needs to be configured in Windows.

Re: SAI - Windows entity does not show up

peterschloenske — Thu, 07 May 2020 11:50:24 GMT

The os:: is set in the inputs.conf, I did not change anything after using the install script.

Re: SAI - Windows entity does not show up

shandr — Tue, 07 Jul 2020 23:56:23 GMT

SAI 2.1.0+ has replaced collectors.conf with entity_classes.conf

Refer to https://docs.splunk.com/Documentation/InfraApp/2.1.0/Install/NewEntitySchema

For Linux [os] see https://community.splunk.com/t5/forums/replypage/board-id/apps-add-ons-all/message-id/59094