Monitoring Splunk

*nix addon doesn't index CPU number

encoretickets
Explorer

Hi,

I've installed the Splunk_TA_nix addon on my indexer.
It brings in the cpu statistics but only as a dump.
The raw data looks like this:

2.13       0.00       1.51       0.00       0.00      96.36
0.00       0.00       1.00       0.00       0.00      99.00
2.02       0.00       3.03       0.00       0.00      94.95
5.00       0.00       3.00       0.00       0.00      92.00
0.00       0.00       0.00       0.00       0.00     100.00
8.00       0.00       4.00       0.00       0.00      88.00
1.00       0.00       1.00       0.00       0.00      98.00
1.00       0.00       0.00       0.00       0.00      99.00
0.00       0.00       0.00       0.00       0.00     100.00

But when I run /opt/splunk/etc/apps/Splunk_TA_nix/bin/cpu.sh I get this:

CPU    pctUser    pctNice  pctSystem  pctIowait    pctIdle
all       4.01       0.00       1.25       0.00      94.74
0         1.00       0.00       2.00       0.00      97.00
1         2.00       0.00       0.00       0.00      98.00
2         3.03       0.00       0.00       0.00      96.97
3         0.00       0.00       0.00       0.00     100.00
4         1.00       0.00       1.00       0.00      98.00
5        20.79       0.00       1.98       0.00      77.23
6         2.00       0.00       4.00       0.00      94.00
7         0.00       0.00       1.00       0.00      99.00

Where is the CPU number (and "all") has gone?
I haven't changed anything in the files, only enabled cpu monitoring.

0 Karma
1 Solution

encoretickets
Explorer
0 Karma

encoretickets
Explorer

Here is the solution: http://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/Releasenotes
Thanks for the help mayurr98!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@encoretickets, If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mayurr98
Super Champion

What is your issue exactly ? Are you able to see logs with the appropriate sourcetype? Search for sourcetype=cpu if you are getting logs then the app is working fine

0 Karma

encoretickets
Explorer

I can't search for the "all" CPU metrics. Or in fact for any given core because the core id is missing from the index.

0 Karma

mayurr98
Super Champion
 index=os sourcetype=cpu CPU=all

Are you getting results for this search?

0 Karma

encoretickets
Explorer

Nope, nothing.

0 Karma

mayurr98
Super Champion
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...