NMON App Configuration

[rojit]

Hi, I am new to NMON apps.
Our Splunk admin team has installed NMON app for us in AIX server. But I am not able to see data from all hosts, which we are suppose to see.

Eg: In our normal search, I am able to see all relevant hosts

But if I query as below:
1)
eventtype="nmon"|dedup host| table host

1 relevant host + 1 host, which splunk installed are displayed

2)
eventtype="nmon:perfromance"|dedup host| table host

1 host only displayed (host in which splunk installed only displayed)

Is there any extra configuration I need to check whether its rightly configured?

Thanks in Advance

[guilmxm]

Hello !

Right, there is actually a trouble shooting guide:

http://nmon-for-splunk.readthedocs.io/en/latest/Userguide.html#troubleshooting-guide-from-a-to-z

In a nutshell, the "eventtype=nmon" will match all events from the TA-nmon including the internal processing and collection events, so it is possible that the host you are looking for is unable to work properly if it is missing some requirements (http://ta-nmon.readthedocs.io/en/latest/requirements.html)

• eventtype=nmon:collect: shows the startup events of the nmon binaries
• eventtype=nmon:processing: shows the processing of events data which transforms the nmon data to be indexed by Splunk
• eventtype=nmon:performance: matches the metric data

The Splunk internal events will show if there is any issue with the host you are looking for, is the host forwarding its internal events properly to your Splunk indexers ?

The Home page of the application contains a "notable events" single form that shows the number of errors encountered, based on the following search:

(eventtype=nmon:processing OR eventtype=nmon:collect error) OR (index=_internal sourcetype=splunkd ERROR ExecProcessor nmon) NOT ("There is no python in" OR "python: not found")

Kind regards,

Guilhem

[rojit]

Thanks @guilmxm
We are checking the issue with the help of truobleshooting link..ll update it further..