https://community.splunk.com/t5/All-Apps-and-Add-ons/SAI-why-no-metrics-from-Linux-with-collectd-write-splunk-plugin/m-p/485131#M62052 <P>Solved, previously I select collectd_htttp as sourcetype, and it seems the em_metrics sourcetype is mandatory for collectd write_splunk plugin, change to em_metrics then solved.<BR /> em_metrics index is also mandatory for SAI, use other index then you have to adjust macros of SAI.</P> <P>So, use em_metrics for both sourcetype and index.</P> Wed, 30 Sep 2020 04:27:06 GMT yhu_splunk 2020-09-30T04:27:06Z https://community.splunk.com/t5/All-Apps-and-Add-ons/SAI-why-no-metrics-from-Linux-with-collectd-write-splunk-plugin/m-p/485130#M62051 <P>I have Splunk App for Infrastructure installed and configured, it works for Windows agent, but I cannot make it for Linux server.</P> <P>Collectd seems runs well with write_splunk plugin, I run search <BR /> index="_introspection" token| spath "data.token_name" | search "data.token_name"="collectd token"<BR /> looks the HEC is receiving data like the screenshot shows.<BR /> <IMG src="https://community.splunk.com/storage/temp/284634-screen-shot-2020-03-03-at-21745-pm.png" alt="alt text" /><BR /> But there is no data of the metrics index assigned to the HEC token, and search for <BR /> | mstats count WHERE index=* AND metric_name=* by host, metric_name<BR /> only Windows host shows. <BR /> <IMG src="https://community.splunk.com/storage/temp/284636-screen-shot-2020-03-03-at-23057-pm.png" alt="alt text" /></P> Wed, 30 Sep 2020 04:27:05 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/SAI-why-no-metrics-from-Linux-with-collectd-write-splunk-plugin/m-p/485130#M62051 yhu_splunk 2020-09-30T04:27:05Z https://community.splunk.com/t5/All-Apps-and-Add-ons/SAI-why-no-metrics-from-Linux-with-collectd-write-splunk-plugin/m-p/485131#M62052 <P>Solved, previously I select collectd_htttp as sourcetype, and it seems the em_metrics sourcetype is mandatory for collectd write_splunk plugin, change to em_metrics then solved.<BR /> em_metrics index is also mandatory for SAI, use other index then you have to adjust macros of SAI.</P> <P>So, use em_metrics for both sourcetype and index.</P> Wed, 30 Sep 2020 04:27:06 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/SAI-why-no-metrics-from-Linux-with-collectd-write-splunk-plugin/m-p/485131#M62052 yhu_splunk 2020-09-30T04:27:06Z https://community.splunk.com/t5/All-Apps-and-Add-ons/SAI-why-no-metrics-from-Linux-with-collectd-write-splunk-plugin/m-p/485132#M62053 <P>OMG! I spent at least a day (off and on) trying to figure this out.<BR /> UGH.<BR /> Thank you so much!!!!!!</P> Fri, 01 May 2020 20:06:28 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/SAI-why-no-metrics-from-Linux-with-collectd-write-splunk-plugin/m-p/485132#M62053 jasonstone 2020-05-01T20:06:28Z