Hi,
in the App for Infrastructure this search returns results for 1x Linux and 1x Windows host. So I assume data is coming in as expected:
| mstats latest(_value) WHERE index=em_metrics metric_name=* BY host, entity_type
However, the windows host does not show up as entity in the investigate tab while the linux host does.
And it is missing here as well:
| inputlookup em_entities
Anyone has an idea what could be wrong here?
Cheers
Increase the "monitoring_calculation_window" for "perfmon" in collectors.conf to something like 300 and restart Splunk
Hello Peter,
Can you share your inputs.conf ?
In my case, I just add _meta = os::Windows
Otherwise, it didn't show up...
The os:: is set in the inputs.conf, I did not change anything after using the install script.
Increase the "monitoring_calculation_window" for "perfmon" in collectors.conf to something like 300 and restart Splunk
SAI 2.1.0+ has replaced collectors.conf with entity_classes.conf
Refer to https://docs.splunk.com/Documentation/InfraApp/2.1.0/Install/NewEntitySchema
For Linux [os] see https://community.splunk.com/t5/forums/replypage/board-id/apps-add-ons-all/message-id/59094
Unfortunately this did not help. I'm still receiving metrics for both hosts, but only the linux host appears in | inputlookup em_entities.
Can you answer some questions:
There are only Process.* metrics available so far.
The latest timestamp with data for this host is 1min ago.
I have SAI 2.0.3 in use.
Sidenote:
In another environment the similar problem occured and here the increase of "monitoring_calculation_window" did the trick. Could you explain what is exactly done with this value?
You need Processor.* metrics for Windows entity discovery. Are they disabled in your inputs.conf.
monitoring_calculation_window is how many seconds to look in past for the new entity. It was set to 90 sec. If there is some data lag of more than 90 sec, entity won't be discovered. Solution is to increase this number if not working for you.
Processor.* are not disabled in the inputs.conf
Maybe something needs to be configured in Windows.