All Apps and Add-ons

no data for cpu.sh *NIX app

rainhailrob
Path Finder

Running Splunk TA on SLES 11 SP1. I ran cpu.sh manually and did not receive any errors. I verified the script is enabled in inputs.conf. There is no data for sourcetype=cpu.

Shows stats per CPU (useful for SMP machines)

[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 300
index = os
disabled = 0

0 Karma
1 Solution

rainhailrob
Path Finder

I was logged in as root.

It looks like my problem was that the sysstat package wasn't installed, although I thought I had verified that the paackage was installed and ran the cpu.sh.

I was missing the sar application.

View solution in original post

rainhailrob
Path Finder

I was logged in as root.

It looks like my problem was that the sysstat package wasn't installed, although I thought I had verified that the paackage was installed and ran the cpu.sh.

I was missing the sar application.

araitz
Splunk Employee
Splunk Employee

Yes, if you can run it manually then it might be related to permissions. What happens if you run $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/unix/bin/cpu.sh? Also, do you see anything if you search for index=_internal sourcetype=splunkd execprocessor or just searching for 'error' OR 'cpu.sh' in the splunkd sourcetype?

rturk
Builder

What user are you running Splunk as? If you try running cpu.sh as that user does it work?

Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...