topic Re: *NIX App File Diff in Getting Data In

*NIX App File Diff

cvajs — Wed, 14 Mar 2012 20:15:10 GMT

i installed the *NIX App, then i chose to monitor /etc of the linux Splunk is installed on. i tested it, modified a junk.conf file 8 times within 15min period. the *NIX App says there were 8 changes but when i click the file path it opens the Search with a Diff in there but the results are null. why? i am doing this as Admin and the OS index is in my default search for the role, etc.

Re: *NIX App File Diff

araitz — Wed, 14 Mar 2012 20:49:30 GMT

This is almost certainly SPL-44701, which will be fixed in the next release of the unix app.

There isn't an easy workaround for now (the fix is to change intentions behavior via application.js), but I think if you change the drilldown search from:

index=os | diff pos1=1 pos2=2 | search source="junk.conf"

to:

index=os source="junk.conf" | diff pos1=1 pos2=2

you should get the expected results.

Re: *NIX App File Diff

cvajs — Wed, 14 Mar 2012 23:24:35 GMT

ok, i will try this new search manually.

Re: *NIX App File Diff

cvajs — Thu, 15 Mar 2012 14:14:02 GMT

also, there are more problems with this app. i goto Configs >>> Config Files Overview, then on left i change to a Count sort, find the file i am interested in, click it, a search opens but finds nothing, there's a quoting problem, after i click the file i want the serach adds a space between last char of file and ending quote, i get no results, but if i remove the space the search works. in fact, this quoting problem exists when any click opens the search in this app, etc.