<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic SAI missing mountpoint from collectd in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/SAI-missing-mountpoint-from-collectd/m-p/504115#M85949</link>
    <description>&lt;P&gt;Hello,&lt;/P&gt;&lt;P&gt;I'm using SAI to get filesystem usage, unfortunately the mountpoint is not populated, or better it is partial.&lt;/P&gt;&lt;P&gt;The following query (KPI in ITSI)&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;| mstats min(df.free) as "df_free" max(df.used) as "df_used" WHERE `sai_metrics_indexes` by host,mount span=30s | eval host_dev = host . ":" . mount&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;doesn't work because the dimension "mount" is missing. Changing "mount" with "device" I get result without mountpoint.&lt;/P&gt;&lt;P&gt;Trying to change the collectd.conf (red part)&lt;/P&gt;&lt;P&gt;&amp;lt;Plugin df&amp;gt;&lt;BR /&gt;FSType "ext2"&lt;BR /&gt;FSType "ext3"&lt;BR /&gt;FSType "ext4"&lt;BR /&gt;FSType "XFS"&lt;BR /&gt;FSType "rootfs"&lt;BR /&gt;FSType "overlay"&lt;BR /&gt;FSType "hfs"&lt;BR /&gt;FSType "apfs"&lt;BR /&gt;FSType "zfs"&lt;BR /&gt;FSType "ufs"&lt;BR /&gt;&lt;FONT color="#FF0000"&gt;MountPoint "/^/.+/"&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#FF0000"&gt;ReportByDevice false&lt;/FONT&gt;&lt;BR /&gt;ValuesAbsolute false&lt;BR /&gt;ValuesPercentage true&lt;BR /&gt;IgnoreSelected false&lt;BR /&gt;&amp;lt;/Plugin&amp;gt;&lt;/P&gt;&lt;P&gt;I get data only from one mountpoint (/boot) the other ones are still missing. I don't understand because the mount dimension is missing and only partial mountpoints are taken.&lt;/P&gt;&lt;P&gt;Is it my fault ?&lt;/P&gt;&lt;P&gt;I use the latest version of SAI, ITSI 4.4.3 and Splunk 8.0.3&lt;/P&gt;&lt;P&gt;Thanks&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 12 Jun 2020 10:45:34 GMT</pubDate>
    <dc:creator>gballanti</dc:creator>
    <dc:date>2020-06-12T10:45:34Z</dc:date>
    <item>
      <title>SAI missing mountpoint from collectd</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/SAI-missing-mountpoint-from-collectd/m-p/504115#M85949</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;&lt;P&gt;I'm using SAI to get filesystem usage, unfortunately the mountpoint is not populated, or better it is partial.&lt;/P&gt;&lt;P&gt;The following query (KPI in ITSI)&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;| mstats min(df.free) as "df_free" max(df.used) as "df_used" WHERE `sai_metrics_indexes` by host,mount span=30s | eval host_dev = host . ":" . mount&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;doesn't work because the dimension "mount" is missing. Changing "mount" with "device" I get result without mountpoint.&lt;/P&gt;&lt;P&gt;Trying to change the collectd.conf (red part)&lt;/P&gt;&lt;P&gt;&amp;lt;Plugin df&amp;gt;&lt;BR /&gt;FSType "ext2"&lt;BR /&gt;FSType "ext3"&lt;BR /&gt;FSType "ext4"&lt;BR /&gt;FSType "XFS"&lt;BR /&gt;FSType "rootfs"&lt;BR /&gt;FSType "overlay"&lt;BR /&gt;FSType "hfs"&lt;BR /&gt;FSType "apfs"&lt;BR /&gt;FSType "zfs"&lt;BR /&gt;FSType "ufs"&lt;BR /&gt;&lt;FONT color="#FF0000"&gt;MountPoint "/^/.+/"&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#FF0000"&gt;ReportByDevice false&lt;/FONT&gt;&lt;BR /&gt;ValuesAbsolute false&lt;BR /&gt;ValuesPercentage true&lt;BR /&gt;IgnoreSelected false&lt;BR /&gt;&amp;lt;/Plugin&amp;gt;&lt;/P&gt;&lt;P&gt;I get data only from one mountpoint (/boot) the other ones are still missing. I don't understand because the mount dimension is missing and only partial mountpoints are taken.&lt;/P&gt;&lt;P&gt;Is it my fault ?&lt;/P&gt;&lt;P&gt;I use the latest version of SAI, ITSI 4.4.3 and Splunk 8.0.3&lt;/P&gt;&lt;P&gt;Thanks&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 12 Jun 2020 10:45:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/SAI-missing-mountpoint-from-collectd/m-p/504115#M85949</guid>
      <dc:creator>gballanti</dc:creator>
      <dc:date>2020-06-12T10:45:34Z</dc:date>
    </item>
  </channel>
</rss>

