Scripted input for iostat only ingesting headers

Sivrat — Mon, 07 Jun 2021 14:49:24 GMT

I've added the Splunk TA for Unix/Linux to my indexers and have been trying to get iostat data feeding in from the indexers.

The script run, but only the headers are present
Sample _raw:
Device rReq_PS wReq_PS rKB_PS wKB_PS avgWaitMillis avgSvcMillis bandwUtilPct

Running 'iostat -xk 1 2' as the script is setup to do does return results.

Running the script normally/debug only shows the headers output to screen, but the debug file show it pulling recording the statistics:
debug--iostat.sh file Output:

Linux 4.18.0-147.8.1.el8_1.x86_64 (hostname) 06/07/2021 _x86_64_ (64 CPU) avg-cpu: %user %nice %system %iowait %steal %idle 16.16 0.00 3.60 1.60 0.00 78.63 Device r/s w/s rkB/s wkB/s rrqm/s wrqm/s %rrqm %wrqm r_await w_await aqu-sz rareq-sz wareq-sz svctm %util sda 52.92 212.80 1675.92 26670.15 7.49 152.92 12.40 41.81 2.40 0.46 0.12 31.67 125.33 0.35 9.19 sdc 138.11 22.04 13308.18 5149.92 0.09 0.26 0.07 1.15 0.33 2.62 0.03 96.36 233.70 0.57 9.19 sdb 548.22 401.94 56049.28 19294.08 0.87 665.61 0.16 62.35 0.10 0.12 0.11 102.24 48.00 0.08 7.70 dm-0 42.67 324.87 1604.43 26506.50 0.00 0.00 0.00 0.00 2.36 0.27 0.06 37.60 81.59 0.24 8.96 dm-1 17.87 40.86 71.48 163.44 0.00 0.00 0.00 0.00 3.01 1.05 0.10 4.00 4.00 0.07 0.39 dm-2 0.00 0.00 0.00 0.21 0.00 0.00 0.00 0.00 40.68 4.93 0.00 81.97 239.35 0.26 0.00 avg-cpu: %user %nice %system %iowait %steal %idle 19.52 0.00 3.07 1.08 0.00 76.33 Device r/s w/s rkB/s wkB/s rrqm/s wrqm/s %rrqm %wrqm r_await w_await aqu-sz rareq-sz wareq-sz svctm %util sda 0.00 11.00 0.00 150.00 0.00 0.00 0.00 0.00 0.00 0.09 0.00 0.00 13.64 1.00 1.10 sdc 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 sdb 6825.00 50.00 27312.00 232.00 0.00 0.00 0.00 0.00 0.32 0.04 0.83 4.00 4.64 0.15 99.80 dm-0 0.00 11.00 0.00 150.00 0.00 0.00 0.00 0.00 0.00 0.09 0.00 0.00 13.64 1.09 1.20 dm-1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 dm-2 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Cmd = [iostat -xk 1 2]; | awk 'BEGIN {print "Device rReq_PS wReq_PS rKB_PS wKB_PS avgWaitMillis avgSvcMillis bandwUtilPct"} /^$/ {next} /^Device:/ {for (i = 1; i <= NF; i++) {if ($i == "svctm") { svctm=i; } else if ($i == "%util") {putil=i;} } reportOrd++; next} (reportOrd<2) {next} {device=$1; rReq_PS=$4; wReq_PS=$5; rKB_PS=$6; wKB_PS=$7; avgWaitMillis=$10; avgSvcMillis=$svctm; bandwUtilPct=$putil} {printf "%-10s %11s %11s %12s %12s %13s %13s %13s\n", device, rReq_PS, wReq_PS, rKB_PS, wKB_PS, avgWaitMillis, avgSvcMillis, bandwUtilPct}' header="Device rReq_PS wReq_PS rKB_PS wKB_PS avgWaitMillis avgSvcMillis bandwUtilPct"

The only thing I can think is that there is some issue with the awk statement maybe? So I be manually adjusting the script?

Re: Scripted input for iostat only ingesting headers

Sivrat — Mon, 07 Jun 2021 17:20:45 GMT

Found my own answer - TA was very out of date. 8.3.0 is working

topic Re: Scripted input for iostat only ingesting headers in Getting Data In

Scripted input for iostat only ingesting headers

Re: Scripted input for iostat only ingesting headers