topic Splunk App for Unix Home/Metrics Empty in All Apps and Add-ons

Splunk App for Unix Home/Metrics Empty

glitchcowboy — Wed, 02 Apr 2014 15:11:16 GMT

Using Splunk App for Unix 5.0.1

I set up a basic category with a couple groups in it with a couple hosts each.

Search Head has SA-nix, Splunk_TA_nix, and splunk_app_for_nix installed.

Indexers have SA-nix and Splunk_TA_nix installed.

UF's have Splunk_TA_nix installed, with inputs enabled.

On the SH I go to metrics, then click on a group and I get nothing "No results found..."

If I search, (e.g.: index=os sourcetype=cpu) I get all the data I want.

Settings/index/sourcetypes are all default, nothing fancy

Why are my home screen/metrics screens are empty?

Re: Splunk App for Unix Home/Metrics Empty

araitz — Wed, 02 Apr 2014 15:26:43 GMT

which metric are you chosing from the dropdown? If you go to the search inspector, what is the full search generated by the page when you get "no results found"?

Re: Splunk App for Unix Home/Metrics Empty

glitchcowboy — Wed, 02 Apr 2014 15:37:30 GMT

well, any metric!

So I go to Hosts, select a host, and then the process stats has an inspector link.

This search has completed and found 1 matching event. However, the transforming commands in the highlighted portion of the following search:

search index=os sourcetype=top host=XYZ  | stats  max(pctCPU) as pctCPU max(pctMEM) as pctMEM last(cpuTIME) as cpuTIME by COMMAND, USER  | eval  CMD=COMMAND  | fields  CMD, USER, pctCPU, pctMEM, cpuTIME

over the time range:

4/2/14 10:30:37.000 AM – 1/1/01 12:00:00.000 AM

generated no results.

Re: Splunk App for Unix Home/Metrics Empty

glitchcowboy — Wed, 02 Apr 2014 15:42:24 GMT

Wait... If I paste that search in (sans the word 'search'), I get no data, but if I put |multikv| in near the beginning it works. Is there some sort of auto-multikv supposed to be going on here?

Re: Splunk App for Unix Home/Metrics Empty

araitz — Wed, 02 Apr 2014 15:52:06 GMT

Yes, you'll see that in the TA there are the following lines:

[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=(^$|[\r\n]+[\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = multi

That last bit says use multi by default. Is it possible that some other app/TA is overriding the TA's config?

Re: Splunk App for Unix Home/Metrics Empty

glitchcowboy — Mon, 28 Sep 2020 16:17:57 GMT

My SearchHead's Splunk_TA_nix was an empty folder. Thus, the KV_MODE was gone.

Replaced Splunk_TA_nix and 'index=os|extract reload=t' and I'm in business.