no data for cpu.sh *NIX app

[rainhailrob]

Running Splunk TA on SLES 11 SP1. I ran cpu.sh manually and did not receive any errors. I verified the script is enabled in inputs.conf. There is no data for sourcetype=cpu.

Shows stats per CPU (useful for SMP machines)

[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 300
index = os
disabled = 0

[rainhailrob · Accepted solution]

I was logged in as root.

It looks like my problem was that the sysstat package wasn't installed, although I thought I had verified that the paackage was installed and ran the cpu.sh.

I was missing the sar application.

[araitz]

Yes, if you can run it manually then it might be related to permissions. What happens if you run $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/unix/bin/cpu.sh? Also, do you see anything if you search for index=_internal sourcetype=splunkd execprocessor or just searching for 'error' OR 'cpu.sh' in the splunkd sourcetype?

[rturk]

What user are you running Splunk as? If you try running cpu.sh as that user does it work?