Splunk IT Service Intelligence

ITSI OS Module documentation issues- inputs for event metrics?

griersoncrick
Explorer

I've noticed an issue with the documentation and configuration for DA-ITSI-OS.

https://docs.splunk.com/Documentation/ITSI/4.13.1/IModules/OSmoduleconfiguration

Firstly, the documentation suggests that If using Splunk_TA_nix, I should enable metrics inputs with the following:

[script://./bin/vmstat.sh]
interval = 60
sourcetype = vmstat
source = vmstat
# index = os
disabled = 0

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
# index = os
disabled = 0

[script://./bin/nfsiostat.sh]
interval = 60
sourcetype = nfsiostat
source = nfsiostat
# index = os
disabled = 0

[script://./bin/ps.sh]
interval = 30
sourcetype = ps
source = ps
# index = os
disabled = 0

[script://./bin/bandwidth.sh]
interval = 60
sourcetype = bandwidth
source = bandwidth
# index = os
disabled = 0

[script://./bin/df.sh]
interval = 300
sourcetype = df
source = df
# index = os
disabled = 0

[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 30
# index = os
disabled = 0

[script://./bin/hardware.sh]
sourcetype = hardware
source = hardware
interval = 36000
# index = os
disabled = 0

[script://./bin/version.sh]
disabled = false
# index = os
interval = 86400
source = Unix:Version
sourcetype = Unix:Version


The problem is, that these are inputs for event metrics and everything else is set up for metrics!

In the actual Splunk_TA_nix, the inputs for metrics versions of those scripts have a different stanza, such as

cpu_metric
df_metric
interfaces_metric
iostat_metric
ps_metric
vmstat_metric

If I simply change the sourcetype, it breaks the input, so by default, all those metrics based scripts output with the metric name using the _metric suffix.

Unfortunately, ALL the ITSI OS module searches are looking for the un suffixed metric names, E.G. cpu, ps, vmstat!

If I alter the searches to look for the updated suffixed metric names, I don't get the OS Host Information panel appearing on the entity within the deep dive or entity view.

So I don't know how, under the configured searches, any of this will work unless heavily modified, or why the documentation points to event log collection scripts  but the module requires metrics indexes given the use of mstats to search.

What am I missing here?



Labels (4)
0 Karma

jcunningham63
Loves-to-Learn Lots

Noticed the same issue here.  There seems to be a discrepancy with how ITSI/IT Work does entity discovery.  Entity types appear to rely on metric data and entity discovery modules on event data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...