topic Re: *nix addon doesn't index CPU number in Monitoring Splunk

*nix addon doesn't index CPU number

encoretickets — Tue, 29 Sep 2020 17:29:56 GMT

Hi,

I've installed the Splunk_TA_nix addon on my indexer.
It brings in the cpu statistics but only as a dump.
The raw data looks like this:

2.13       0.00       1.51       0.00       0.00      96.36
0.00       0.00       1.00       0.00       0.00      99.00
2.02       0.00       3.03       0.00       0.00      94.95
5.00       0.00       3.00       0.00       0.00      92.00
0.00       0.00       0.00       0.00       0.00     100.00
8.00       0.00       4.00       0.00       0.00      88.00
1.00       0.00       1.00       0.00       0.00      98.00
1.00       0.00       0.00       0.00       0.00      99.00
0.00       0.00       0.00       0.00       0.00     100.00

But when I run /opt/splunk/etc/apps/Splunk_TA_nix/bin/cpu.sh I get this:

CPU    pctUser    pctNice  pctSystem  pctIowait    pctIdle
all       4.01       0.00       1.25       0.00      94.74
0         1.00       0.00       2.00       0.00      97.00
1         2.00       0.00       0.00       0.00      98.00
2         3.03       0.00       0.00       0.00      96.97
3         0.00       0.00       0.00       0.00     100.00
4         1.00       0.00       1.00       0.00      98.00
5        20.79       0.00       1.98       0.00      77.23
6         2.00       0.00       4.00       0.00      94.00
7         0.00       0.00       1.00       0.00      99.00

Where is the CPU number (and "all") has gone?
I haven't changed anything in the files, only enabled cpu monitoring.

Re: *nix addon doesn't index CPU number

mayurr98 — Fri, 05 Jan 2018 12:54:27 GMT

What is your issue exactly ? Are you able to see logs with the appropriate sourcetype? Search for sourcetype=cpu if you are getting logs then the app is working fine