All Apps and Add-ons

Splunk App for Infrastructure doesn't detect entities


Hi hi ninjas!
My windows hosts don't appear as Entities in Investigation dashboard. I'm getting events and metrics from those hosts, but app doesn't recognize them.

What I've done so far:
1. Installed SAI app and addon

2. Followed the easy installation guide in Add data settings and got the command to run on the hosts

3. Run the command in powershell, it has installed UF with pre-configured inputs.conf. little preview of it:




# *** Configure Metrics & Logs collected ***
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 60
object = Processor
mode = single
useEnglishOnly = true
sourcetype = PerfmonMetrics:CPU
index = em_metrics
_meta =  os::"Microsoft Windows Server 2012 R2 Standard" os_version::6.3.9600 ip::"" entity_type::Windows_Host



 4. Splunk instance is receiving metrics and events(app, sec and system) from the host, but host is not recognized in SAI. It still shows that I have 0 entities.

Btw: I've single instance deployment of Splunk.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...