I've added the Splunk TA for Unix/Linux to my indexers and have been trying to get iostat data feeding in from the indexers.
The script run, but only the headers are present
Sample _raw:
Device rReq_PS wReq_PS rKB_PS wKB_PS avgWaitMillis avgSvcMillis bandwUtilPct
Running 'iostat -xk 1 2' as the script is setup to do does return results.
Running the script normally/debug only shows the headers output to screen, but the debug file show it pulling recording the statistics:
debug--iostat.sh file Output:
Linux 4.18.0-147.8.1.el8_1.x86_64 (hostname) 06/07/2021 _x86_64_ (64 CPU)
avg-cpu: %user %nice %system %iowait %steal %idle
16.16 0.00 3.60 1.60 0.00 78.63
Device r/s w/s rkB/s wkB/s rrqm/s wrqm/s %rrqm %wrqm r_await w_await aqu-sz rareq-sz wareq-sz svctm %util
sda 52.92 212.80 1675.92 26670.15 7.49 152.92 12.40 41.81 2.40 0.46 0.12 31.67 125.33 0.35 9.19
sdc 138.11 22.04 13308.18 5149.92 0.09 0.26 0.07 1.15 0.33 2.62 0.03 96.36 233.70 0.57 9.19
sdb 548.22 401.94 56049.28 19294.08 0.87 665.61 0.16 62.35 0.10 0.12 0.11 102.24 48.00 0.08 7.70
dm-0 42.67 324.87 1604.43 26506.50 0.00 0.00 0.00 0.00 2.36 0.27 0.06 37.60 81.59 0.24 8.96
dm-1 17.87 40.86 71.48 163.44 0.00 0.00 0.00 0.00 3.01 1.05 0.10 4.00 4.00 0.07 0.39
dm-2 0.00 0.00 0.00 0.21 0.00 0.00 0.00 0.00 40.68 4.93 0.00 81.97 239.35 0.26 0.00
avg-cpu: %user %nice %system %iowait %steal %idle
19.52 0.00 3.07 1.08 0.00 76.33
Device r/s w/s rkB/s wkB/s rrqm/s wrqm/s %rrqm %wrqm r_await w_await aqu-sz rareq-sz wareq-sz svctm %util
sda 0.00 11.00 0.00 150.00 0.00 0.00 0.00 0.00 0.00 0.09 0.00 0.00 13.64 1.00 1.10
sdc 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
sdb 6825.00 50.00 27312.00 232.00 0.00 0.00 0.00 0.00 0.32 0.04 0.83 4.00 4.64 0.15 99.80
dm-0 0.00 11.00 0.00 150.00 0.00 0.00 0.00 0.00 0.00 0.09 0.00 0.00 13.64 1.09 1.20
dm-1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
dm-2 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
Cmd = [iostat -xk 1 2]; | awk 'BEGIN {print "Device rReq_PS wReq_PS rKB_PS wKB_PS avgWaitMillis avgSvcMillis bandwUtilPct"} /^$/ {next} /^Device:/ {for (i = 1; i <= NF; i++) {if ($i == "svctm") { svctm=i; } else if ($i == "%util") {putil=i;} } reportOrd++; next} (reportOrd<2) {next} {device=$1; rReq_PS=$4; wReq_PS=$5; rKB_PS=$6; wKB_PS=$7; avgWaitMillis=$10; avgSvcMillis=$svctm; bandwUtilPct=$putil} {printf "%-10s %11s %11s %12s %12s %13s %13s %13s\n", device, rReq_PS, wReq_PS, rKB_PS, wKB_PS, avgWaitMillis, avgSvcMillis, bandwUtilPct}' header="Device rReq_PS wReq_PS rKB_PS wKB_PS avgWaitMillis avgSvcMillis bandwUtilPct"
The only thing I can think is that there is some issue with the awk statement maybe? So I be manually adjusting the script?
Found my own answer - TA was very out of date. 8.3.0 is working