All Apps and Add-ons

Splunk add-on for Unix and Linux - data not transformed

faustf
Communicator

Hi guys,
I've installed the Splunk App for Unix and Linux in my Splunk server (I've only 1 splunk server and N splunk universal forwarder).
On each forwarder I've installed the Splunk Add-on for Unix and Linux.
The data are are synchronized in the "os" index without problem.

But If I take a look at the data, I noticed that Splunk cannot extract the fields:

alt text

I checked the transforms.conf of the Splunk Add-on and I can see, for example, that a transformation for the CPU has been defined

#CPU    pctUser    pctNice  pctSystem  pctIowait    pctIdle
#all          1          0          1          ?         97
[fields_for_cpu_sh]
REGEX = all\s+(\d*\.*\d*)\s+(\d*\.*\d*)\s+(\d*\.*\d*)\s+(\d*\.*\d*)\s+(\d*\.*\d*)
FORMAT = pctUser::$1 pctNice::$2 pctSystem::$3 pctIowait::$4 pctIdle::$5

But it seems that it is not applied to my data.
I tried to search where the "fields_for_cpu_sh" is used in the configuration files but I couldn't find it (exception for the transforms.conf)

What am I missing?

thanks

0 Karma
1 Solution

faustf
Communicator

I figured out what was the problem:

I forgot to install the Unix Add-on on the indexer

View solution in original post

0 Karma

faustf
Communicator

I figured out what was the problem:

I forgot to install the Unix Add-on on the indexer

0 Karma

adonio
Ultra Champion

can you try and search in verbose mode?

0 Karma

faustf
Communicator

Thank for answering,
The output seems the same:
alt text

Maybe I'm mistaking, but shouldn't I find the string "fields_for_cpu_sh" in another configuration file?

For example, in my custom application I defined a transformation (MYTRANSFORMATION) in trasformations.conf , and in the props.conf file of my app I defined also:

[my-source-type]
REPORT-fields = MYTRANSFORMATION

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...