topic Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head in Splunk Enterprise

Why is Splunk App for Unix and Linux not listing all the fields for index=os sourcetype=cpu on search head?

Ashwini008 — Thu, 04 Aug 2022 14:27:47 GMT

Hi ,

I have splunk_TA_NIX app installed on indexer,Heavy Forwarder and search heads.

When i search index=os sourcetype=cpu on indexers i can see below fields.

But same query when i run on search heads i dont see any of those fields it is just below fields

Any solution on how to get all the fields on search heads?

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

richgalloway — Mon, 26 Jul 2021 18:49:18 GMT

Verify the TA is installed on the search heads and that its permissions are set to Global.

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

Ashwini008 — Tue, 27 Jul 2021 06:44:58 GMT

@richgalloway It is present on Search head

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

Ashwini008 — Tue, 27 Jul 2021 17:00:07 GMT

@gcusello @scelikok @Anonymous @woodcock Any suggestions?

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

gcusello — Tue, 27 Jul 2021 17:11:59 GMT

Hi @Ashwini008,

a first really stupid question: are you searching in Verbose Mode obviously?

Anyway, as hinted by @richgalloway, check if the knowledge objects (field extractions) are Global in TA_nix, not only the App.

Ciao.

Giuseppe

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

Ashwini008 — Tue, 27 Jul 2021 19:03:06 GMT

@gcusello Yes i am running it in Verbose mode and knowledge objects have Global Permission

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

gcusello — Wed, 28 Jul 2021 06:21:51 GMT

Hi @Ashwini008,

try to force the use of a field adding one field (e.g. CPU or another) to your search:

index=os sourcetype=cpu CPU=*

and see if in this way you can see fields.

Then see in [Settings -- Sourcetypes] if there's te cpu sourcetype.

Ciao.

Giuseppe

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

Ashwini008 — Wed, 28 Jul 2021 09:08:04 GMT

@gcusello I dont see the fields when i run

 index=os sourcetype=cpu CPU=*

since CPU field is not present.CPU sourcetype is defined in inputs.conf and props.conf.

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

gcusello — Wed, 28 Jul 2021 12:36:21 GMT

Hi @Ashwini008,

when you run the above search, have you results or not?

if the field is not extracted, you shouldn't have any result, if instead it's extracted, you should see the fields.

if you see in [Settings -- Sourcetypes], have you the "cpu" sourcetype?

Ciao.

Giuseppe

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

Ashwini008 — Wed, 28 Jul 2021 12:49:42 GMT

@gcusello I dont see the result when i run this query index=os sourcetype=cpu CPU=*

And i see the sourcetype cpu in settings.

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

gcusello — Wed, 28 Jul 2021 13:12:24 GMT

Hi @Ashwini008,

if you haven't any result with that search, it means that the field extraction isn't active in that App.

In [Settings -- Sourcetypes], which id the App of cpu sourcetype?

It should be TA_nix, enter in it and run your search to see if you see the fields.

If you see the fields in the TA_nix app, it means that the permissions aren't correct because in te App it runs.

If you don't see the fields in the TA_nix, it means that there's a problem, so delete the app from the Search Head and deploy it again.

Ciao.

Giuseppe

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

scelikok — Wed, 28 Jul 2021 17:03:20 GMT

Hi @Ashwini008,

Can you please run below command on search head and post the result? Maybe there is another props setting on your search heads that overwrites field extraction.

splunk btool props list cpu --debug | grep local

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

Ashwini008 — Wed, 28 Jul 2021 17:18:49 GMT

@gcusello Thanks for your inputs. I don't see any results when i run the query from the TA_NIX app.

I deleted and redeployed the application again.But No luck

Any other way out you could think of ?

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

Ashwini008 — Wed, 28 Jul 2021 18:11:21 GMT

Hi @scelikok

bin]$ ./splunk btool props list cpu --debug | grep local
/opt/app/splunk/splunk/etc/system/local/props.conf MAX_DAYS_HENCE = 40
/opt/app/splunk/splunk/etc/system/local/props.conf MAX_DAYS_HENCE = 40

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

scelikok — Thu, 29 Jul 2021 07:32:36 GMT

Hi @Ashwini008,

It seems there is no overwrite for cpu sourcetype. Can you please also show us below output? Let's see if default sourcetype settings is shown?

splunk btool props list cpu --debug

Re: Splunk App for Unix and Linux is not listing all the fields for index=os sourcetype=cpu on search head

igor04653 — Thu, 04 Aug 2022 10:38:54 GMT

Hello
Were you able to solve this problem? I have the same problem. On some hosts the CPU=all field is available and on some hosts it is not