No display for "netstat" sourcetype for Solaris


We have splunk add-on for Unix installed. But it does not show any data for "netstat" sourcetype for Soalris clients. For Linux it does. Incidentally, Linuxhosts are indexers and heavy forwarders.

/app/splunk/splunkforwarder/etc/apps/Splunk_TA_nix/bin/ is present in Solaris client, and it does output typical netstat like output.

Why are no data displayed in Splunk Web console?

Tags (1)
0 Karma


As per script compatibility table,
netstat is supported only for Linux. I am surprised because the script , works in Solaris

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!