ITSI OS Module documentation issues- inputs for event metrics?

griersoncrick — Wed, 19 Oct 2022 16:42:34 GMT

I've noticed an issue with the documentation and configuration for DA-ITSI-OS.

https://docs.splunk.com/Documentation/ITSI/4.13.1/IModules/OSmoduleconfiguration

Firstly, the documentation suggests that If using Splunk_TA_nix, I should enable metrics inputs with the following:

[script://./bin/vmstat.sh]
interval = 60
sourcetype = vmstat
source = vmstat
# index = os
disabled = 0

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
# index = os
disabled = 0

[script://./bin/nfsiostat.sh]
interval = 60
sourcetype = nfsiostat
source = nfsiostat
# index = os
disabled = 0

[script://./bin/ps.sh]
interval = 30
sourcetype = ps
source = ps
# index = os
disabled = 0

[script://./bin/bandwidth.sh]
interval = 60
sourcetype = bandwidth
source = bandwidth
# index = os
disabled = 0

[script://./bin/df.sh]
interval = 300
sourcetype = df
source = df
# index = os
disabled = 0

[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 30
# index = os
disabled = 0

[script://./bin/hardware.sh]
sourcetype = hardware
source = hardware
interval = 36000
# index = os
disabled = 0

[script://./bin/version.sh]
disabled = false
# index = os
interval = 86400
source = Unix:Version
sourcetype = Unix:Version

The problem is, that these are inputs for event metrics and everything else is set up for metrics!

In the actual Splunk_TA_nix, the inputs for metrics versions of those scripts have a different stanza, such as

cpu_metric
df_metric
interfaces_metric
iostat_metric
ps_metric
vmstat_metric

If I simply change the sourcetype, it breaks the input, so by default, all those metrics based scripts output with the metric name using the _metric suffix.

Unfortunately, ALL the ITSI OS module searches are looking for the un suffixed metric names, E.G. cpu, ps, vmstat!

If I alter the searches to look for the updated suffixed metric names, I don't get the OS Host Information panel appearing on the entity within the deep dive or entity view.

So I don't know how, under the configured searches, any of this will work unless heavily modified, or why the documentation points to event log collection scripts but the module requires metrics indexes given the use of mstats to search.

What am I missing here?

Re: ITSI OS Module documentation issues

jcunningham63 — Wed, 19 Oct 2022 15:56:00 GMT

Noticed the same issue here. There seems to be a discrepancy with how ITSI/IT Work does entity discovery. Entity types appear to rely on metric data and entity discovery modules on event data.

topic ITSI OS Module documentation issues- inputs for event metrics? in Splunk ITSI

ITSI OS Module documentation issues- inputs for event metrics?

Re: ITSI OS Module documentation issues