Splunk Nmon app OStype not populating for AIX

[jpagan]

We are using the TA-nmon add on. We only use the light forwarder on our AIX hosts and therefore do not have python on these lpars. However, Perl is installed. I configured the TA to use the nmon2csv.pl instead of the python version.

I am getting some data in the dashboards now, but OStype is not being extracted correctly So the AIX hosts only appear under "Any Hosts" but not under "AIX" when the AIX radio button is selected in a dashboard. Linux hosts are using nmon2csv.py and those dashboards are working fine. Only AIX does not work.

Any ideas how to fix?

[guilmxm · Accepted solution]

Hi,

The OStype filtering uses a lookup table which is by default generated each night at 1h AM (lookup nmon_inventory, generated by a scheduled search)

After adding new hosts, you can manually generate the lookup table by running the report: "Generate NMON Inventory Lookup Table"
Once the lookup table has been generated, you should find your AIX hosts in inventory interfaces "CONFIG: Hosts Simple Inventory"

If you find your AIX hosts in the inventory interface, then OStype filtering will work as expected.

Note: If you are running a cluster, the lookup table must be updated or synced in each search head. If you're using search head clustering from 6.2, this is automatic. In non sh clustering, you can set to run in one search head then sync it to other search heads.

[jpagan]

Thanks. You were spot on, everything was working this morning!

[guilmxm]

Great 🙂

You're welcome

If you like the App, don't hesitate to rate it, i like stars 🙂

[jpagan]

Done. Rated - 5 stars. Thanks again!