App for linux scripts not showing data

[aramp]

Hello there

I have this issue in the "Splunk app for unix/linux" I cannot see data under the web interface for host, memory, cpu..

got this error:

(Web view)
Specification
CPU: unknown - is cpu.sh enabled?
RAM: unknown - is vmstat.sh enabled?
Disk: unknown - is df.sh enabled?
Capacity: unknown - is df.sh enabled?

but when I go to setting page for configuring in the preview mode I'm able to see data..

** I already run scripts directly at server(forwarder) and works well (with splunk forwarder user)
** When I tried to search info (cpu for example) in the "search tab" I'm able to see the info..
**The sysstat package is already installed .
**I verify the index=OS is in default view

Thanks for your help

[sloshburch]

Check out what's on Troubleshoot the Splunk App for Unix and Linux. The part on dropdowns.csv might be effective here.

[pappjr]

The dashboards use macros and form tokens. The form tokens are populated from the dropdowns which I believe are populated by a lookup generating search. Are your dropdowns populated on the home dashboard?

[tobais]

Same issue and yes the drop downs populate with Group = Default (there are about 50 servers showing up in that group under settings>category)...it just spins "Searching for data" and nothing loads. When I enabled the .sh scripts the first time, got a blurb of data for about 20 minutes, then nothing. Data is loaded into index, sourcetypes, everything...just the app dashboards are dead.

[jpapp]

@tobias - are you accessing these dashboards as a user with the "admin" role? This will help rule out any potential permissions issues.

[adonio]

try and search index=os and verify the data is there first

[aramp]

yep data Is already display in search mode..

[adonio]

is it a single splunk instance?

[aramp]

I have one server configured as indexer with the app for linux installed:
This server is receiving the forwarder info.

And other server as heavy forwarder with the add on installed, I have no distributed environments yet.