All Apps and Add-ons

SAI + Nmon (Unix hosts) - entities are not showing up

alexeyglukhov
Path Finder

Hello all !
I did read all the missing entities cases here, but mine is slightly different.
I am trying to feed metrics from Unix Nmon into SAI and those metrics are coming into metrics index.

I configured needed parameters:
_meta = entity_type::nix_host in inputs.conf
nmon-metrics index added into SAI indexes macro
sourcetype = em_metrics is host assignment (MetaData:Host) - it is done my Nmon's TRANSFORMS-hostfield=nmon_metrics_csv_hostoverride

Windows entities (perfmon config for metrics) appeared in SAI, but not Unix ones.

I am attaching a few screenshots to compare what metrics coming from Windows and Unix - my suspicion is:
SAI expects certain metric naming convention
SAI expects additional mandatory dimensions (other than entity_type::nix_host)
or something else

Any help will be appreciated.
alt text

alt text

0 Karma
1 Solution

alexeyglukhov
Path Finder

Ok, everyone !

Research showed that SAI has two saved searches:
for Windows hosts - "Entity Class - perfmon", which searches for metrics with "Processor." or "processor."

| mcatalog values("host") as "dimension.identifier.host" [ mcatalog values(_dims) as info where **metric_name=Processor.* OR metric_name=processor.*** AND (`sai_metrics_indexes`)...

for Unix hosts - "Entity Class - os", which searches for metrics with "cpu.*"

| mcatalog values("host") as "dimension.identifier.host" [ mcatalog values(_dims) as info where **metric_name=cpu.*** AND (`sai_metrics_indexes`)...

So, add cpu. prefix to your custom metrics (in my case I modified Nmon parser scripts)
It can be only CPU related metrics or all - up to you, but I assume if CPU metrics stopped coming, after some time that entity might get status either disabled or disappear even though other metrics will still be coming.

Or modify saved search to include your metrics' prefix.

Happy splunking 🙂

View solution in original post

0 Karma

alexeyglukhov
Path Finder

Ok, everyone !

Research showed that SAI has two saved searches:
for Windows hosts - "Entity Class - perfmon", which searches for metrics with "Processor." or "processor."

| mcatalog values("host") as "dimension.identifier.host" [ mcatalog values(_dims) as info where **metric_name=Processor.* OR metric_name=processor.*** AND (`sai_metrics_indexes`)...

for Unix hosts - "Entity Class - os", which searches for metrics with "cpu.*"

| mcatalog values("host") as "dimension.identifier.host" [ mcatalog values(_dims) as info where **metric_name=cpu.*** AND (`sai_metrics_indexes`)...

So, add cpu. prefix to your custom metrics (in my case I modified Nmon parser scripts)
It can be only CPU related metrics or all - up to you, but I assume if CPU metrics stopped coming, after some time that entity might get status either disabled or disappear even though other metrics will still be coming.

Or modify saved search to include your metrics' prefix.

Happy splunking 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...