All Apps and Add-ons

Missing OSType in inventory

rmorlen_splunk
Splunk Employee
Splunk Employee

I can find the nmon_config.OSType in the DataModel by running "| datamodel NMON_Config search ".

Looking at the macro called to generate the lookup "nmon_inventory_update" I don't get the OSType returned from the tstats command.

Breaking down the tstats search and running "| tstats latest("Nmon_Config.OStype") as OStype from datamodel=NMON_Config where (nodename = Nmon_Config) (sourcetype=nmon_config) groupby host prestats=false"

OStype comes back Unknown.

Suggestions?

0 Karma

guilmxm
Influencer

Hi !

Please apologise for late replying, I didn't see any notification of your post.

Right, the "OStype" field is an extracted field for the nmon_config sourcetype, looking at the datamodel definition it is:

case(isnotnull(OStype), OStype, isnull(OStype), case(OS == "Linux", "Linux", OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX", isnull(OS), "Unknown") )

The first condition is expected to match the "OStype" field extraction achieved at props.conf level with:

EVAL-OStype = case(AAA_OS == "Linux", "Linux", AAA_OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX", isnull(AAA_OS), "Unknown")

However, the fields between the datamodel and the props extraction have the same name, moreover since it is available at the props level there is no interest in evaluating it within the data model.

I have logged an issue in Git: https://github.com/guilhemmarchand/nmon-for-splunk/issues/95

Could you try to:

  • Edit the datamodel (disable first the acceleration to be able to edit)
  • Remove the OStype field
  • Add an auto-extracted field and select the OStype field (string) which should be available automatically
  • re-enable the acceleration and re-build the acceleration

alt text

After that, the OStype should be returned correctly from the tstats command (from your own search):

| tstats latest("Nmon_Config.OStype") as OStype from datamodel=NMON_Config where (nodename = Nmon_Config) (sourcetype=nmon_config) groupby host prestats=false

This will be corrected in next release, you can also download the json file from the testing repo:

https://github.com/guilhemmarchand/nmon-for-splunk/tree/testing/nmon/default/data/models

I have updated the json file a few minutes ago.

Thank you!

Guilhem

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...