Issues with 'lsof_sos.sh' have been reported lately, but we haven't had the opportunity to dig deeper into them or reproduce the problem in-house yet. You may want to look up that Splunk Answer I just linked and use the work-around provided if you find out that manually running
$SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/sos/bin/lsof_sos.sh yields no output.
Now you have mentioned it, when I click Sos -> Resource Usage -> File Descriptor Usage - it falshes up a screen for a second and I saw that file name lsof_sos.sh in bold but didn't have time to read the text around it before the usage page loaded.
I enabled all the scripts in the manager for sos in the end
For file descriptor usage, you need to enable 'lsof_sos.sh'. You'll find these requirements explained in the README file of the app or in the "Learn More" panel of the respective views. We always point out post-installation actions needed to enable a view in that panel 🙂