I can find the nmon_config.OSType in the DataModel by running "| datamodel NMON_Config search ".
Looking at the macro called to generate the lookup "nmon_inventory_update" I don't get the OSType returned from the tstats command.
Breaking down the tstats search and running "| tstats latest("Nmon_Config.OStype") as OStype from datamodel=NMON_Config where (nodename = Nmon_Config) (sourcetype=nmon_config) groupby host prestats=false"
OStype comes back Unknown.
Suggestions?
Hi !
Please apologise for late replying, I didn't see any notification of your post.
Right, the "OStype" field is an extracted field for the nmon_config sourcetype, looking at the datamodel definition it is:
case(isnotnull(OStype), OStype, isnull(OStype), case(OS == "Linux", "Linux", OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX", isnull(OS), "Unknown") )
The first condition is expected to match the "OStype" field extraction achieved at props.conf level with:
EVAL-OStype = case(AAA_OS == "Linux", "Linux", AAA_OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX", isnull(AAA_OS), "Unknown")
However, the fields between the datamodel and the props extraction have the same name, moreover since it is available at the props level there is no interest in evaluating it within the data model.
I have logged an issue in Git: https://github.com/guilhemmarchand/nmon-for-splunk/issues/95
Could you try to:
After that, the OStype should be returned correctly from the tstats command (from your own search):
| tstats latest("Nmon_Config.OStype") as OStype from datamodel=NMON_Config where (nodename = Nmon_Config) (sourcetype=nmon_config) groupby host prestats=false
This will be corrected in next release, you can also download the json file from the testing repo:
https://github.com/guilhemmarchand/nmon-for-splunk/tree/testing/nmon/default/data/models
I have updated the json file a few minutes ago.
Thank you!
Guilhem