All Apps and Add-ons script modification help


I wanted to have additional data sent to the indexer from the UF using the Splunk Add-On for NIX. I modified the script where it runs iostat -xk on the server to get avgrq-sz, r_await and w_await metrics. In the script I added the fields I wanted with descriptive names (although maybe I shouldn't have) and hoped that it would be displayed when I run the search index=os sourcetype=isostat. I can find the fields is I run the search index=os sourcetype=isostat | fields - avgrq-sz. If I tried to run it index=os sourcetype=isostat avgrq-sz>5 (test purposes) I get no events found. Eventually I would like to set this up as an alert to possible disk degradation.

Any assistance would be greatly appreciated. Thank you!

0 Karma

Ultra Champion

sample logs please.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...