All Apps and Add-ons
Highlighted

SAI + Nmon (Unix hosts) - entities are not showing up

Path Finder

Hello all !
I did read all the missing entities cases here, but mine is slightly different.
I am trying to feed metrics from Unix Nmon into SAI and those metrics are coming into metrics index.

I configured needed parameters:
meta = entitytype::nixhost in inputs.conf
nmon-metrics index added into SAI indexes macro
sourcetype = em
metrics is host assignment (MetaData:Host) - it is done my Nmon's TRANSFORMS-hostfield=nmonmetricscsv_hostoverride

Windows entities (perfmon config for metrics) appeared in SAI, but not Unix ones.

I am attaching a few screenshots to compare what metrics coming from Windows and Unix - my suspicion is:
SAI expects certain metric naming convention
SAI expects additional mandatory dimensions (other than entitytype::nixhost)
or something else

Any help will be appreciated.
alt text

alt text

0 Karma
Highlighted

Re: SAI + Nmon (Unix hosts) - entities are not showing up

Path Finder

Ok, everyone !

Research showed that SAI has two saved searches:
for Windows hosts - "Entity Class - perfmon", which searches for metrics with "Processor." or "processor."

| mcatalog values("host") as "dimension.identifier.host" [ mcatalog values(_dims) as info where **metric_name=Processor.* OR metric_name=processor.*** AND (`sai_metrics_indexes`)...

for Unix hosts - "Entity Class - os", which searches for metrics with "cpu.*"

| mcatalog values("host") as "dimension.identifier.host" [ mcatalog values(_dims) as info where **metric_name=cpu.*** AND (`sai_metrics_indexes`)...

So, add cpu. prefix to your custom metrics (in my case I modified Nmon parser scripts)
It can be only CPU related metrics or all - up to you, but I assume if CPU metrics stopped coming, after some time that entity might get status either disabled or disappear even though other metrics will still be coming.

Or modify saved search to include your metrics' prefix.

Happy splunking 🙂

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.