All Apps and Add-ons

TA-nmon Show Zero Values

mspiewak
Explorer

Is it possible for the TA-nmon add-on to send "0" for a metric value rather than nothing? We're using the metrics index and for example when a specific disk is not busy it doesn't report any value for the os.unix.nmon.storage.diskbusy metric. We ran into a similar issue with perfmon data on Windows and there is an attribute we could add to the stanza to resolve that (showZeroValue = 1), so I'm looking to do something similar with nmon.

0 Karma
1 Solution

guilmxm
SplunkTrust
SplunkTrust

Hi @mspiewak

I understand we are talking about the TA-metricator-for-nmon. (https://splunkbase.splunk.com/app/3948/)

Yes, currently at the backend level, 0 values are removed before submitting to Splunk monitoring, which purpose was to avoid charging the license costs and simulating those at the SPL level.
But I appreciate it cannot always be simulated, specially on when there is a total lack of activity on this metric / device.

I have logged an enhanced request, such option will be provided in nmon.conf to allow disabling this filtering.

Kind regards,

Guilhem

View solution in original post

guilmxm
SplunkTrust
SplunkTrust

Hello @mspiewak

A new release was published of the TA-metricator-for-nmon with the version 1.0.10

In the this new version, you can activate a new option in a local/nmon.conf which enables generating 0 value metrics, literately this avoids filtering out metrics with a 0 value. (which is the case by default)

Example:

#######################
# nmon parsers options:
#######################

# consult the documentation to get the full list of available options

# --mode fifo|colddata --> explicitly manage data in fifo/colddata
# --use_fqdn --> use the host fully qualified domain name (default)
# --silent --> minimize the processing output to save data volume (deactivated by default)
# --show_zero_values --> allows generating metrics with 0 values (default removes any metric with a zero value before it reaches the ingestion)

# In fifo mode, options are sent by the metricator_consumer.sh
# In file mode, options are sent by Splunk via the nmon_processing stanza in props.conf

nmonparser_options="--mode fifo --use_fqdn --silent --show_zero_values"

Feel free to let me know if you encounter any issue.

Guilhem

guilmxm
SplunkTrust
SplunkTrust

Hi @mspiewak

I understand we are talking about the TA-metricator-for-nmon. (https://splunkbase.splunk.com/app/3948/)

Yes, currently at the backend level, 0 values are removed before submitting to Splunk monitoring, which purpose was to avoid charging the license costs and simulating those at the SPL level.
But I appreciate it cannot always be simulated, specially on when there is a total lack of activity on this metric / device.

I have logged an enhanced request, such option will be provided in nmon.conf to allow disabling this filtering.

Kind regards,

Guilhem

Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...