All Apps and Add-ons

Splunk App for Infrastructure doesn't detect entities

damiko
Communicator

Hi hi ninjas!
My windows hosts don't appear as Entities in Investigation dashboard. I'm getting events and metrics from those hosts, but app doesn't recognize them.

What I've done so far:
1. Installed SAI app and addon

2. Followed the easy installation guide in Add data settings and got the command to run on the hosts

3. Run the command in powershell, it has installed UF with pre-configured inputs.conf. little preview of it:

 

 

 

# *** Configure Metrics & Logs collected ***
[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 60
object = Processor
mode = single
useEnglishOnly = true
sourcetype = PerfmonMetrics:CPU
index = em_metrics
_meta =  os::"Microsoft Windows Server 2012 R2 Standard" os_version::6.3.9600 ip::"192.168.10.225" entity_type::Windows_Host

 

 

 4. Splunk instance is receiving metrics and events(app, sec and system) from the host, but host is not recognized in SAI. It still shows that I have 0 entities.

Btw: I've single instance deployment of Splunk.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...