All Apps and Add-ons

Splunk App for Unix Home/Metrics Empty

Path Finder

Using Splunk App for Unix 5.0.1

I set up a basic category with a couple groups in it with a couple hosts each.

Search Head has SA-nix, Splunk_TA_nix, and splunk_app_for_nix installed.

Indexers have SA-nix and Splunk_TA_nix installed.

UF's have Splunk_TA_nix installed, with inputs enabled.

On the SH I go to metrics, then click on a group and I get nothing "No results found..."

If I search, (e.g.: index=os sourcetype=cpu) I get all the data I want.

Settings/index/sourcetypes are all default, nothing fancy

Why are my home screen/metrics screens are empty?

0 Karma
1 Solution

Path Finder

My SearchHead's SplunkTAnix was an empty folder. Thus, the KV_MODE was gone.

Replaced SplunkTAnix and 'index=os|extract reload=t' and I'm in business.

View solution in original post

0 Karma

Path Finder

My SearchHead's SplunkTAnix was an empty folder. Thus, the KV_MODE was gone.

Replaced SplunkTAnix and 'index=os|extract reload=t' and I'm in business.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Yes, you'll see that in the TA there are the following lines:

[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=(^$|[\r\n]+[\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = multi

That last bit says use multi by default. Is it possible that some other app/TA is overriding the TA's config?

Path Finder

Wait... If I paste that search in (sans the word 'search'), I get no data, but if I put |multikv| in near the beginning it works. Is there some sort of auto-multikv supposed to be going on here?

0 Karma

Path Finder

well, any metric!

So I go to Hosts, select a host, and then the process stats has an inspector link.

This search has completed and found 1 matching event. However, the transforming commands in the highlighted portion of the following search:

search index=os sourcetype=top host=XYZ  | stats  max(pctCPU) as pctCPU max(pctMEM) as pctMEM last(cpuTIME) as cpuTIME by COMMAND, USER  | eval  CMD=COMMAND  | fields  CMD, USER, pctCPU, pctMEM, cpuTIME

over the time range:

4/2/14 10:30:37.000 AM – 1/1/01 12:00:00.000 AM

generated no results.

0 Karma

Splunk Employee
Splunk Employee

which metric are you chosing from the dropdown? If you go to the search inspector, what is the full search generated by the page when you get "no results found"?

0 Karma