Splunk app for Unix and Linux: Why is the app not getting cpu or ram data?

[ihiesbkalai]

I configured the app but I am not getting any results for CPU or RAM when I preview index=os. I do get values but only for the host and not the forwarders and I followed all the documentation to set up the app and the addon. I am not getting the most crucial info.

[Amandeepsin]

Hi,

I am getting the same error. Can any one help me solving this

Nothing can been seen under sourcetype = cpu and vmstats but ps, hardware, df are working

Thanks,

[zsanchez113]

Are you able to get any other data from the forwarder?

[Amandeepsin]

yes. getting other logs but not for cpu and memory. For ps, harware, disk it is working fine
can you please help

[mhigginson]

Do you have the sysstat software package installed?

From the docs: http://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/Platformandhardwarerequirements
"What other items does the add-on require?
The Splunk Add-on for Unix and Linux requires the sysstat software package to function properly. You can download the sysstat utilities from the sysstat utilities download page or from your local package repository (depending on the version of *nix your host runs.)

On RHEL 7 and CentOS 7, the Splunk Add-on for Unix and Linux requires the net-tools software package to function properly. You can install the net-tools utilities from the OS' package repository using the command "sudo yum install net-tools"."

[HiroshiSatoh]

Did you also install add-ons on forwarders? Add-ons are also required on the forwarder side.
Also, have you got other logs (_internalt etc.) from the forwarder?

[Amandeepsin]

yes. getting other logs but not for cpu and memory. For ps, harware, disk it is working fine
can you please help