Missing OSType in inventory

[rmorlen_splunk]

I can find the nmon_config.OSType in the DataModel by running "| datamodel NMON_Config search ".

Looking at the macro called to generate the lookup "nmon_inventory_update" I don't get the OSType returned from the tstats command.

Breaking down the tstats search and running "| tstats latest("Nmon_Config.OStype") as OStype from datamodel=NMON_Config where (nodename = Nmon_Config) (sourcetype=nmon_config) groupby host prestats=false"

OStype comes back Unknown.

Suggestions?

[guilmxm]

Hi !

Please apologise for late replying, I didn't see any notification of your post.

Right, the "OStype" field is an extracted field for the nmon_config sourcetype, looking at the datamodel definition it is:

case(isnotnull(OStype), OStype, isnull(OStype), case(OS == "Linux", "Linux", OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX", isnull(OS), "Unknown") )

The first condition is expected to match the "OStype" field extraction achieved at props.conf level with:

EVAL-OStype = case(AAA_OS == "Linux", "Linux", AAA_OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX", isnull(AAA_OS), "Unknown")

However, the fields between the datamodel and the props extraction have the same name, moreover since it is available at the props level there is no interest in evaluating it within the data model.

I have logged an issue in Git: https://github.com/guilhemmarchand/nmon-for-splunk/issues/95

Could you try to:

• Edit the datamodel (disable first the acceleration to be able to edit)
• Remove the OStype field
• Add an auto-extracted field and select the OStype field (string) which should be available automatically
• re-enable the acceleration and re-build the acceleration

After that, the OStype should be returned correctly from the tstats command (from your own search):

| tstats latest("Nmon_Config.OStype") as OStype from datamodel=NMON_Config where (nodename = Nmon_Config) (sourcetype=nmon_config) groupby host prestats=false

This will be corrected in next release, you can also download the json file from the testing repo:

https://github.com/guilhemmarchand/nmon-for-splunk/tree/testing/nmon/default/data/models

I have updated the json file a few minutes ago.

Thank you!

Guilhem