All Apps and Add-ons

Splunk App for Infrastructure doesn't detect entities

damiko
Communicator

Hi hi ninjas!
My windows hosts don't appear as Entities in Investigation dashboard. I'm getting events and metrics from those hosts, but app doesn't recognize them.

What I've done so far:
1. Installed SAI app and addon

2. Followed the easy installation guide in Add data settings and got the command to run on the hosts

3. Run the command in powershell, it has installed UF with pre-configured inputs.conf. little preview of it:

 

 

 

# *** Configure Metrics & Logs collected ***
[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 60
object = Processor
mode = single
useEnglishOnly = true
sourcetype = PerfmonMetrics:CPU
index = em_metrics
_meta =  os::"Microsoft Windows Server 2012 R2 Standard" os_version::6.3.9600 ip::"192.168.10.225" entity_type::Windows_Host

 

 

 4. Splunk instance is receiving metrics and events(app, sec and system) from the host, but host is not recognized in SAI. It still shows that I have 0 entities.

Btw: I've single instance deployment of Splunk.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...