All Apps and Add-ons

Installing the Splunk App and Add-on for Unix and Linux in my search head cluster, why am I unable add categories/groups?

pkeller
Contributor

I installed the Splunk App for Unix and Linux 5.0.2 on my search head cluster. Installed the SA-nix app on the search heads and indexers, and deployed the Splunk Add-on for Unix and Linux everywhere.

Now when I try to go into setup to add categories/groups, I create a category, then add a group to it ... and immediately the app starts spinning on 'loading' (in the "Hosts not in" area). It never ends. I assumed that was related to the dynamically created dropdowns.csv but I'm not positive. On the indexers, dropdowns.csv does get created when Splunk is restarted, but it doesn't really represent every host that would be sending data to my indexing pool.

On the search heads, I tried manually generating my own dropdowns.csv, that prepopulated categories and groups with hosts.

But ultimately, the search heads started complaining like mad about stuff not being on the indexers.

I have since removed SA-nix from everywhere.

My question would be .. does this sound familiar, or is there more detailed documentation about these lookups that the app is dependent on and how to ensure that they're all available?

rsimmons
Splunk Employee
Splunk Employee

Support for SHC for the NIX App is currently in progress but isn't available as of yet.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...