Getting Data In

*NIX App File Diff

cvajs
Contributor

i installed the *NIX App, then i chose to monitor /etc of the linux Splunk is installed on. i tested it, modified a junk.conf file 8 times within 15min period. the *NIX App says there were 8 changes but when i click the file path it opens the Search with a Diff in there but the results are null. why? i am doing this as Admin and the OS index is in my default search for the role, etc.

Tags (3)

araitz
Splunk Employee
Splunk Employee

This is almost certainly SPL-44701, which will be fixed in the next release of the unix app.

There isn't an easy workaround for now (the fix is to change intentions behavior via application.js), but I think if you change the drilldown search from:

index=os | diff pos1=1 pos2=2 | search source="junk.conf"

to:

index=os source="junk.conf" | diff pos1=1 pos2=2 

you should get the expected results.

0 Karma

cvajs
Contributor

also, there are more problems with this app. i goto Configs >>> Config Files Overview, then on left i change to a Count sort, find the file i am interested in, click it, a search opens but finds nothing, there's a quoting problem, after i click the file i want the serach adds a space between last char of file and ending quote, i get no results, but if i remove the space the search works. in fact, this quoting problem exists when any click opens the search in this app, etc.

0 Karma

cvajs
Contributor

ok, i will try this new search manually.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...