Splunk App for Unix and Linux: After configuring hosts, why are some hosts not showing up for these 3 sourcetypes?

[dbcase]

Hi,

I have about a dozen hosts that I'm working on getting configured using the Splunk App for Unix and Linux. I've configured other hosts before and those work great, but these hosts are acting a bit weird.

When I use sourcetype=df, 11 out of the 12 hosts show up and work fine
When I use sourcetype=cpu, only 3 out of the 12 hosts show up and one of the three is the missing host from above
When I use sourcetype=vmstat, only 3 out of the 12 hosts show up and one of the three is the missing host from above

I've restarted, rebuilt, and still no luck. Thoughts?

[renjith_nair · Accepted solution]

Hello @dbcase,

• Check the splunkd logs on the hosts which haven't turned up. You should be able to find hints for your problem
• Try to execute the script manually from the hosts and see if it's throwing any error. Most probably the basic package which is used by the scripts might be missing from the hosts, for eg: sysstat

[dbcase]

Thanks Renjith!!! Your hints set me in the right direction. Turns out sysstat wasn't installed on most of the machines. Once it was installed everything is humming along just fine.

The first one (the df one), the problem host is a Darwin host and it reports the disk partitions differently. Just had to adjust the query to include that and presto! It works!

Thank you!!!

[dbcase]

Oh.... and I've checked inputs.conf in Splunk_TA_nix/local and it is identical across all 12 servers.