Splunk App for Unix Home/Metrics Empty

[glitchcowboy]

Using Splunk App for Unix 5.0.1

I set up a basic category with a couple groups in it with a couple hosts each.

Search Head has SA-nix, Splunk_TA_nix, and splunk_app_for_nix installed.

Indexers have SA-nix and Splunk_TA_nix installed.

UF's have Splunk_TA_nix installed, with inputs enabled.

On the SH I go to metrics, then click on a group and I get nothing "No results found..."

If I search, (e.g.: index=os sourcetype=cpu) I get all the data I want.

Settings/index/sourcetypes are all default, nothing fancy

Why are my home screen/metrics screens are empty?

[glitchcowboy · Accepted solution]

My SearchHead's Splunk_TA_nix was an empty folder. Thus, the KV_MODE was gone.

Replaced Splunk_TA_nix and 'index=os|extract reload=t' and I'm in business.

[araitz]

Yes, you'll see that in the TA there are the following lines:

[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=(^$|[\r\n]+[\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = multi

That last bit says use multi by default. Is it possible that some other app/TA is overriding the TA's config?

[glitchcowboy]

Wait... If I paste that search in (sans the word 'search'), I get no data, but if I put |multikv| in near the beginning it works. Is there some sort of auto-multikv supposed to be going on here?

[glitchcowboy]

well, any metric!

So I go to Hosts, select a host, and then the process stats has an inspector link.

This search has completed and found 1 matching event. However, the transforming commands in the highlighted portion of the following search:

search index=os sourcetype=top host=XYZ  | stats  max(pctCPU) as pctCPU max(pctMEM) as pctMEM last(cpuTIME) as cpuTIME by COMMAND, USER  | eval  CMD=COMMAND  | fields  CMD, USER, pctCPU, pctMEM, cpuTIME

over the time range:

4/2/14 10:30:37.000 AM – 1/1/01 12:00:00.000 AM

generated no results.

[araitz]

which metric are you chosing from the dropdown? If you go to the search inspector, what is the full search generated by the page when you get "no results found"?