Why does the Splunk App for Unix and Linux not show CPU usage on Ubuntu?

[konstantin_zsen]

Hi,

I have installed the Splunk App for Unix and Linux, enabled cpu.sh, and installed sysstat package. Also, I have added to inputs.conf (.../etc/system/local/) the following stanza:

[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 300
index = os
disabled = 0

But "CPU Used By Group" in the Splunk App for Unix shows "No Results Found".

In S.o.S I can see CPU usage.

Thank you for any help.

[Amandeepsin]

Hi,

You need to install sysstat package in linux as it doesn't come preloded with it.. Additionally, you have to make following changes in web.conf file

[settings]
minify_js = True

Restart service. It should work fine

[lloydknight]

Have you checked the permission of the cpu.sh script? The script should be in executable permission. Also check the splunkd.log for errors.

Hope it helps!

Thanks!

[johnsplunk01]

This issue is not caused by the Splunk_TA_nix addon app. I do see both cpu and mem data coming in to the splunk enterprise/monitoring instance when doing a preview in the splunk_app_for_nix settings tab.

It appears to be an issue with the splunk_app_for_nix application itself, not being able to interpret or read the incoming data for cpu and mem. The metrics tab on splunk_app_for_nix is also blank.

[johnsplunk01]

I am having the same issue. The cpu and mem shows NONE under the Hosts Tab. Were you able to resolve this issue?

[lfedak_splunk]

Hey @johnsplunk01, Please use the comment button when leaving a comment! I went ahead and converted this one from an answer to a comment.

[konstantin_zsen]

cpu.sh works perfectly when I run ones manually under root.

[konstantin_zsen]

Follow searches returns results:
index=os sourcetype=os host=ubuntu
index=os sourcetype=top host=ubuntu

This example also return results - "index=os sourcetype=top host=ubuntu | chart avg(pctCPU) as avgCPU avg(pctMEM) as avgMEM by _time".

Splunk App for Unix does not see cpu.
I'm slightly disappointed.

[konstantin_zsen]

May be my problem related with permissions?