Hello !
Right, there is actually a trouble shooting guide:
http://nmon-for-splunk.readthedocs.io/en/latest/Userguide.html#troubleshooting-guide-from-a-to-z
In a nutshell, the "eventtype=nmon" will match all events from the TA-nmon including the internal processing and collection events, so it is possible that the host you are looking for is unable to work properly if it is missing some requirements (http://ta-nmon.readthedocs.io/en/latest/requirements.html)
- eventtype=nmon:collect: shows the startup events of the nmon binaries
- eventtype=nmon:processing: shows the processing of events data which transforms the nmon data to be indexed by Splunk
- eventtype=nmon:performance: matches the metric data
The Splunk internal events will show if there is any issue with the host you are looking for, is the host forwarding its internal events properly to your Splunk indexers ?
The Home page of the application contains a "notable events" single form that shows the number of errors encountered, based on the following search:
(eventtype=nmon:processing OR eventtype=nmon:collect error) OR (index=_internal sourcetype=splunkd ERROR ExecProcessor nmon) NOT ("There is no python in" OR "python: not found")
Kind regards,
Guilhem
