No results found. Inspect ...

[michaeloleary]

Hi Folks,

Forgive me if this was already raised but I haven't found anything on Splunk base that matches my exact problem. I'm running into a little issue with the Unix Application version 4.5 and the Scripted inputs on Splunk version 4.3.1. I've install my Splunk instance on Ubuntu 11.10. I have enabled all scripted inputs in the setup of the *Nix 4.5 application. However the CPU graph "Percent Load by Host" continues failing to render any graphs.

In the search application I have run a search for "index=os sourcetype=cpu host=*" and I can see no "sourcetype=cpu". I've tried running the command directly from the unix application bin directory and I'm coming up with no results back to the command. Has anyone come across this problem before?

Thanks for any help you can provide.

[araitz · Accepted solution]

On Debian, sometimes the systat package is not installed by default, so sar and some other commands that we need don't work and there are no results. Ask your ubuntu admin to:

apt get sysstat

[michaeloleary]

Perfect! Thank you very much. Worked a treat.