Hi hi ninjas!
My windows hosts don't appear as Entities in Investigation dashboard. I'm getting events and metrics from those hosts, but app doesn't recognize them.
What I've done so far:
1. Installed SAI app and addon
2. Followed the easy installation guide in Add data settings and got the command to run on the hosts
3. Run the command in powershell, it has installed UF with pre-configured inputs.conf. little preview of it:
# *** Configure Metrics & Logs collected ***
[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 60
object = Processor
mode = single
useEnglishOnly = true
sourcetype = PerfmonMetrics:CPU
index = em_metrics
_meta = os::"Microsoft Windows Server 2012 R2 Standard" os_version::6.3.9600 ip::"192.168.10.225" entity_type::Windows_Host
4. Splunk instance is receiving metrics and events(app, sec and system) from the host, but host is not recognized in SAI. It still shows that I have 0 entities.
Btw: I've single instance deployment of Splunk.
