Splunk App for Unix and Linux configuration

[swdowiarz]

Hi

I've installed Splunk App for Unix and Linux and Splunk Add-on for Unix and Linux. I want to monitor basic things about my machine as CPU usage, memory etc.
In documentation I've read that for the first install there is no need to do any changes in Settings -> Your Data.

When I want to display home dashboard it shows No results found. Can it be connected with sourcetype in Settings -> your data, because I leave it with default.
I would be grateful for some advice.

[harsmarvania57]

So based on my understanding, you are not able to see any data in Splunk App for Unix and Linux Dashboard, in that case have you configured Splunk App for Unix and Linux, reference docs http://docs.splunk.com/Documentation/UnixApp/5.2.3/User/First-timeconfiguration and if you go to next pages it will give you idea about different dashboards/pages.

If data is coming from Add-on with default sourcetype then in App for Unix and Linux Settings-> Your Data page you need to click save button.

[harsmarvania57]

Hi @swdowiarz,

You need to configure Splunk Add-on for Unix and Linux first which will run different script at certain interval (You can configure this) to monitor CPU, Memory, Disk Usage etc. Please refer this documentation to configure Splunk Add-on for Unix and Linux so that it will send data to Indexers and after that you can search data from Search head.

I hope this helps.

Thanks,
Harshil

[swdowiarz]

I did configuration for Splunk Add-on for Unix and Linux and all the inputs are enable, but there still nothing to show.

[harsmarvania57]

Have you installed this add-on on Indexers as well because add-on will send data to os index, so you must have os index on Indexers.

[swdowiarz]

Yes, I did it, when I search index=os there are lot of events but instead of dashboards there is still No results found