Monitoring Splunk

*nix addon doesn't index CPU number

encoretickets
Explorer

Hi,

I've installed the Splunk_TA_nix addon on my indexer.
It brings in the cpu statistics but only as a dump.
The raw data looks like this:

2.13       0.00       1.51       0.00       0.00      96.36
0.00       0.00       1.00       0.00       0.00      99.00
2.02       0.00       3.03       0.00       0.00      94.95
5.00       0.00       3.00       0.00       0.00      92.00
0.00       0.00       0.00       0.00       0.00     100.00
8.00       0.00       4.00       0.00       0.00      88.00
1.00       0.00       1.00       0.00       0.00      98.00
1.00       0.00       0.00       0.00       0.00      99.00
0.00       0.00       0.00       0.00       0.00     100.00

But when I run /opt/splunk/etc/apps/Splunk_TA_nix/bin/cpu.sh I get this:

CPU    pctUser    pctNice  pctSystem  pctIowait    pctIdle
all       4.01       0.00       1.25       0.00      94.74
0         1.00       0.00       2.00       0.00      97.00
1         2.00       0.00       0.00       0.00      98.00
2         3.03       0.00       0.00       0.00      96.97
3         0.00       0.00       0.00       0.00     100.00
4         1.00       0.00       1.00       0.00      98.00
5        20.79       0.00       1.98       0.00      77.23
6         2.00       0.00       4.00       0.00      94.00
7         0.00       0.00       1.00       0.00      99.00

Where is the CPU number (and "all") has gone?
I haven't changed anything in the files, only enabled cpu monitoring.

0 Karma
1 Solution

encoretickets
Explorer
0 Karma

encoretickets
Explorer

Here is the solution: http://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/Releasenotes
Thanks for the help mayurr98!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@encoretickets, If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

mayurr98
Super Champion

What is your issue exactly ? Are you able to see logs with the appropriate sourcetype? Search for sourcetype=cpu if you are getting logs then the app is working fine

0 Karma

encoretickets
Explorer

I can't search for the "all" CPU metrics. Or in fact for any given core because the core id is missing from the index.

0 Karma

mayurr98
Super Champion
 index=os sourcetype=cpu CPU=all

Are you getting results for this search?

0 Karma

encoretickets
Explorer

Nope, nothing.

0 Karma

mayurr98
Super Champion
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...