I have this issue in the "Splunk app for unix/linux" I cannot see data under the web interface for host, memory, cpu..
got this error:
CPU: unknown - is cpu.sh enabled?
RAM: unknown - is vmstat.sh enabled?
Disk: unknown - is df.sh enabled?
Capacity: unknown - is df.sh enabled?
but when I go to setting page for configuring in the preview mode I'm able to see data..
** I already run scripts directly at server(forwarder) and works well (with splunk forwarder user)
** When I tried to search info (cpu for example) in the "search tab" I'm able to see the info..
**The sysstat package is already installed .
**I verify the index=OS is in default view
Thanks for your help
Check out what's on Troubleshoot the Splunk App for Unix and Linux. The part on dropdowns.csv might be effective here.
The dashboards use macros and form tokens. The form tokens are populated from the dropdowns which I believe are populated by a lookup generating search. Are your dropdowns populated on the home dashboard?
Same issue and yes the drop downs populate with Group = Default (there are about 50 servers showing up in that group under settings>category)...it just spins "Searching for data" and nothing loads. When I enabled the .sh scripts the first time, got a blurb of data for about 20 minutes, then nothing. Data is loaded into index, sourcetypes, everything...just the app dashboards are dead.
@tobias - are you accessing these dashboards as a user with the "admin" role? This will help rule out any potential permissions issues.
try and search index=os and verify the data is there first
yep data Is already display in search mode..
is it a single splunk instance?
I have one server configured as indexer with the app for linux installed:
This server is receiving the forwarder info.
And other server as heavy forwarder with the add on installed, I have no distributed environments yet.