All Apps and Add-ons

Splunk App for Unix and Linux configuration

swdowiarz
Path Finder

Hi

I've installed Splunk App for Unix and Linux and Splunk Add-on for Unix and Linux. I want to monitor basic things about my machine as CPU usage, memory etc.
In documentation I've read that for the first install there is no need to do any changes in Settings -> Your Data.

When I want to display home dashboard it shows No results found. Can it be connected with sourcetype in Settings -> your data, because I leave it with default.
I would be grateful for some advice.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

So based on my understanding, you are not able to see any data in Splunk App for Unix and Linux Dashboard, in that case have you configured Splunk App for Unix and Linux, reference docs http://docs.splunk.com/Documentation/UnixApp/5.2.3/User/First-timeconfiguration and if you go to next pages it will give you idea about different dashboards/pages.

If data is coming from Add-on with default sourcetype then in App for Unix and Linux Settings-> Your Data page you need to click save button.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @swdowiarz,

You need to configure Splunk Add-on for Unix and Linux first which will run different script at certain interval (You can configure this) to monitor CPU, Memory, Disk Usage etc. Please refer this documentation to configure Splunk Add-on for Unix and Linux so that it will send data to Indexers and after that you can search data from Search head.

I hope this helps.

Thanks,
Harshil

0 Karma

swdowiarz
Path Finder

I did configuration for Splunk Add-on for Unix and Linux and all the inputs are enable, but there still nothing to show.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Have you installed this add-on on Indexers as well because add-on will send data to os index, so you must have os index on Indexers.

0 Karma

swdowiarz
Path Finder

Yes, I did it, when I search index=os there are lot of events but instead of dashboards there is still No results found

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...