dashboards not populating

[Esky73]

Playing around with meh-trics for the first time - i have configured a single host with collectd (CentOS7)

• i can see the metrics in the collectd index
• i can browse using metric explorer and metric navigator.

but all the other dashboards, Overview, cpu etc do not populate.

Looking at the troubleshooting section on splunkbase :

• | mcatalog values(metric_name) provides no results.
• | mstats min(_value) AS Min avg(_value) AS Avg max(_value) as "Max" WHERE metric_name=disk.disk_io_time.io_time index="*" by host - does tho
• the host multiselect dropdown has the following search : | mcatalog values(host) AS host | mvexpand host which also doesn't provide any output.

Any ideas whats going on here ?

thanks.

[lukeh · Accepted solution]

Add the collectd index to "Indexes searched by default" :-
https://docs.splunk.com/Documentation/Splunk/latest/Search/Searchindexes#Control_index_access_using_...

Hope this helps 🙂

[Esky73]

Damn .. RTFM fail .. thankyou.

[teknofile]

I have a similar issue - I have added the indexes search by default already. I can see some data (memory, packet throughput, disk) but I do not see any CPU data populated in the graphs. Using the metrics navigator I can drill down though. Not sure where I should start in troubleshooting the dash board.

I tried to copy the query some of the graphs used in the Search & Reporting window, but it gave me a "Error in 'mstats' command: Unsupported aggregation type: $statsfunc$" so I dont think I can do it that way.

[lukeh]

you're welcome 🙂