Splunk IT Service Intelligence

ITSI OS Module documentation issues- inputs for event metrics?

griersoncrick
Explorer

I've noticed an issue with the documentation and configuration for DA-ITSI-OS.

https://docs.splunk.com/Documentation/ITSI/4.13.1/IModules/OSmoduleconfiguration

Firstly, the documentation suggests that If using Splunk_TA_nix, I should enable metrics inputs with the following:

[script://./bin/vmstat.sh]
interval = 60
sourcetype = vmstat
source = vmstat
# index = os
disabled = 0

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
# index = os
disabled = 0

[script://./bin/nfsiostat.sh]
interval = 60
sourcetype = nfsiostat
source = nfsiostat
# index = os
disabled = 0

[script://./bin/ps.sh]
interval = 30
sourcetype = ps
source = ps
# index = os
disabled = 0

[script://./bin/bandwidth.sh]
interval = 60
sourcetype = bandwidth
source = bandwidth
# index = os
disabled = 0

[script://./bin/df.sh]
interval = 300
sourcetype = df
source = df
# index = os
disabled = 0

[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 30
# index = os
disabled = 0

[script://./bin/hardware.sh]
sourcetype = hardware
source = hardware
interval = 36000
# index = os
disabled = 0

[script://./bin/version.sh]
disabled = false
# index = os
interval = 86400
source = Unix:Version
sourcetype = Unix:Version


The problem is, that these are inputs for event metrics and everything else is set up for metrics!

In the actual Splunk_TA_nix, the inputs for metrics versions of those scripts have a different stanza, such as

cpu_metric
df_metric
interfaces_metric
iostat_metric
ps_metric
vmstat_metric

If I simply change the sourcetype, it breaks the input, so by default, all those metrics based scripts output with the metric name using the _metric suffix.

Unfortunately, ALL the ITSI OS module searches are looking for the un suffixed metric names, E.G. cpu, ps, vmstat!

If I alter the searches to look for the updated suffixed metric names, I don't get the OS Host Information panel appearing on the entity within the deep dive or entity view.

So I don't know how, under the configured searches, any of this will work unless heavily modified, or why the documentation points to event log collection scripts  but the module requires metrics indexes given the use of mstats to search.

What am I missing here?



Labels (4)
0 Karma

jcunningham63
Loves-to-Learn Lots

Noticed the same issue here.  There seems to be a discrepancy with how ITSI/IT Work does entity discovery.  Entity types appear to rely on metric data and entity discovery modules on event data.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...