Hi !
Please apologise for late replying, I didn't see any notification of your post.
Right, the "OStype" field is an extracted field for the nmon_config sourcetype, looking at the datamodel definition it is:
case(isnotnull(OStype), OStype, isnull(OStype), case(OS == "Linux", "Linux", OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX", isnull(OS), "Unknown") )
The first condition is expected to match the "OStype" field extraction achieved at props.conf level with:
EVAL-OStype = case(AAA_OS == "Linux", "Linux", AAA_OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX", isnull(AAA_OS), "Unknown")
However, the fields between the datamodel and the props extraction have the same name, moreover since it is available at the props level there is no interest in evaluating it within the data model.
I have logged an issue in Git: https://github.com/guilhemmarchand/nmon-for-splunk/issues/95
Could you try to:
- Edit the datamodel (disable first the acceleration to be able to edit)
- Remove the OStype field
- Add an auto-extracted field and select the OStype field (string) which should be available automatically
- re-enable the acceleration and re-build the acceleration
After that, the OStype should be returned correctly from the tstats command (from your own search):
| tstats latest("Nmon_Config.OStype") as OStype from datamodel=NMON_Config where (nodename = Nmon_Config) (sourcetype=nmon_config) groupby host prestats=false
This will be corrected in next release, you can also download the json file from the testing repo:
https://github.com/guilhemmarchand/nmon-for-splunk/tree/testing/nmon/default/data/models
I have updated the json file a few minutes ago.
Thank you!
Guilhem
