Hi , We have configured Splunk App for Unix and Linux to all our hosts and we're facing a weird issue.
This app is working fine on all our Linux and HP UX boxes, but on Solaris boxes vmstat is not working as expected.
Issues:
On Linux or HP UX , fields are extracted properly and see data. But for Solaris, fields are not extracted properly and we see incorrect data.
Below is sample log file
memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi
16384 439337 -422953 2681.5 -2581.5 77 36.4 0 13949520474 10370043883 20143325 123 727 0.31
memUsedPct and memFreePct values are incorrect values and this should be same for all the other values.
Can someone please suggest on this?
Below is Python script which is calling this data:
"x$KERNEL" = "xSunOS" ] ; then
assertHaveCommand vmstat
assertHaveCommandGivenPath /usr/sbin/swap
assertHaveCommandGivenPath /usr/sbin/prtconf
assertHaveCommand prstat
if [ $SOLARIS_8 -o $SOLARIS_9 ] ; then
CMD='eval /usr/sbin/prtconf 2>/dev/null | grep Memory ; /usr/sbin/swap -s ; vmstat 1 1 ; vmstat -s ; prstat -n 1 1 1'
else
CMD='eval /usr/sbin/prtconf 2>/dev/null | grep Memory ; /usr/sbin/swap -s ; vmstat -q 1 1 ; vmstat -s ; prstat -n 1 1 1'
fi
PARSE_0='/^Memory size:/ {memTotalMB=$3} (NR==5) {memFreeMB=$5 / 1024}'
PARSE_1='(NR==2) {swapUsed=0+$(NF-3); swapFree=0+$(NF-1)}'
PARSE_2='/pages paged out$/ {pgPageOut=$1} /pages swapped out$/ {pgSwapOut=$1}'
PARSE_3='/cpu context switches$/ {cSwitches=$1} /device interrupts$/ {interrupts=$1} / v?forks$/ {forks+=$1}'
PARSE_4='/^Total: / {processes=$2; threads=$4; loadAvg1mi=0+$(NF-2)}'
Since I don't see where the script is creating these fields it makes me think there is more to the script or the fields in question are evaluated.
You can probably fix this using the props.conf in the apps local directory to evaluate the same field names.
[sourcetypeName]
EVAL-memUsedPct= memUsedMB/memTotalMB*100
EVAL-memFreePct= memFreeMB/memTotalMB*100
Added below lines, but this is not solving the problem.. Still I could see events in the same forat.
I believe above lines are already added to script.