All Apps and Add-ons

Why does the Splunk App for Unix and Linux not show CPU usage on Ubuntu?

konstantin_zsen
Path Finder

Hi,

I have installed the Splunk App for Unix and Linux, enabled cpu.sh, and installed sysstat package. Also, I have added to inputs.conf (.../etc/system/local/) the following stanza:

[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 300
index = os
disabled = 0

But "CPU Used By Group" in the Splunk App for Unix shows "No Results Found".

In S.o.S I can see CPU usage.

Thank you for any help.

0 Karma

Amandeepsin
New Member

Hi,

You need to install sysstat package in linux as it doesn't come preloded with it.. Additionally, you have to make following changes in web.conf file

[settings]
minify_js = True

Restart service. It should work fine

0 Karma

lloydknight
Builder

Have you checked the permission of the cpu.sh script? The script should be in executable permission. Also check the splunkd.log for errors.

Hope it helps!

Thanks!

0 Karma

johnsplunk01
New Member

This issue is not caused by the Splunk_TA_nix addon app. I do see both cpu and mem data coming in to the splunk enterprise/monitoring instance when doing a preview in the splunk_app_for_nix settings tab.

It appears to be an issue with the splunk_app_for_nix application itself, not being able to interpret or read the incoming data for cpu and mem. The metrics tab on splunk_app_for_nix is also blank.

0 Karma

johnsplunk01
New Member

I am having the same issue. The cpu and mem shows NONE under the Hosts Tab. Were you able to resolve this issue?

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @johnsplunk01, Please use the comment button when leaving a comment! I went ahead and converted this one from an answer to a comment.

0 Karma

konstantin_zsen
Path Finder

cpu.sh works perfectly when I run ones manually under root.

0 Karma

konstantin_zsen
Path Finder

Follow searches returns results:
index=os sourcetype=os host=ubuntu
index=os sourcetype=top host=ubuntu

This example also return results - "index=os sourcetype=top host=ubuntu | chart avg(pctCPU) as avgCPU avg(pctMEM) as avgMEM by _time".

Splunk App for Unix does not see cpu.
I'm slightly disappointed.

0 Karma

konstantin_zsen
Path Finder

May be my problem related with permissions?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...