All Apps and Add-ons

How come, in the Splunk App for Infrastructure, some Entities are missing?

martinha1
New Member

The Universal Forwarder is sending Data. the Data will be indexed in the Splunk Enterprise server and I see data in the metrics log files on the client and on the Splunk Server.

But, for two Windows 10 Clients, I get no Entity. On the Splunk Server, I have the Infrastructure App and the Add-on installed and on the Client, I have installed the Universal Forwarder with the Scripts as described in "App: Splunk App for Infrastructure -> Add Data -> Windows".

Actually, I have 3 Entities (two Linux Server and one Windows Server) but for the Win10 Agents, I have no Entity.

0 Karma

mattymo
Splunk Employee
Splunk Employee

Is this Windows 10 Pro? Home?

I am setting up a forwarder on a gift for the kiddo 🙂 going to test in a day or two. Will have Win10 Home Edition. Probably shouldn't matter, but just checking to be thorough.

- MattyMo
0 Karma

dagarwal_splunk
Splunk Employee
Splunk Employee

Try some of these steps first :
1) Can you check if the UF on the Windows machine is actually sending data? ".\splunk list forward-server". If you don't have any user login created on UF, you can use this: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/User-seedconf

2) Make sure "outputs.conf" in UF is sending data to Infrastructure App.

3) Use Enterprise search to check if Windows metrics data is coming. Something like: " | mstats avg(_value) WHERE metric_name=* AND index=em_metrics AND entity_type=Windows_Host by metric_name"

martinha1
New Member

thx I did the steps and it looks like as the UF is sending data but only from one metric

1) I have created a user login with a hashed PW but I get a "login failed" message

2) outputs.conf content
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.11.12.13:9997

3) I tried two searches
| mstats avg(_value) WHERE metric_name=* AND index=em_metrics AND entity_type=Windows_Host AND host=working-w2k12r2vm by metric_name
returns 164,450 events from 26 different metrics (Memory.Cache_Bytes, Process.%_User_Time, System.Threads, ...)

| mstats avg(_value) WHERE metric_name=* AND index=em_metrics AND entity_type=Windows_Host AND host=notworking-win10vm by metric_name
returns 2,961 events from 1 metric (System.Threads)

0 Karma

dagarwal_splunk
Splunk Employee
Splunk Employee

You should check the inputs.conf file on your UF. Make sure you have the perfmon stanzas like this :

[perfmon://CPU Load]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 30
object = Processor
index = em_metrics
_meta = entity_type::Windows_Host

  • You will need the "Processor" object for entity to be discovered.
  • index=em_metrics and _meta = entity_type::Windows_Host are required.
0 Karma

martinha1
New Member

hi dagarwal, the UF installations inputs.conf file, that delivers metrics have the same content as the UF installations that are not deliver metrics but i will test that.
thx

0 Karma

mattymo
Splunk Employee
Splunk Employee

I recommend also installing the metrics workspace - https://splunkbase.splunk.com/app/4192/ - s a good sanity check for App for Infra, as it will display any metrics that make it into the metric store without relying on entity correlation magic.

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...