Splunk IT Service Intelligence

ITSI OS Module documentation issues- inputs for event metrics?


I've noticed an issue with the documentation and configuration for DA-ITSI-OS.


Firstly, the documentation suggests that If using Splunk_TA_nix, I should enable metrics inputs with the following:

interval = 60
sourcetype = vmstat
source = vmstat
# index = os
disabled = 0

interval = 60
sourcetype = iostat
source = iostat
# index = os
disabled = 0

interval = 60
sourcetype = nfsiostat
source = nfsiostat
# index = os
disabled = 0

interval = 30
sourcetype = ps
source = ps
# index = os
disabled = 0

interval = 60
sourcetype = bandwidth
source = bandwidth
# index = os
disabled = 0

interval = 300
sourcetype = df
source = df
# index = os
disabled = 0

sourcetype = cpu
source = cpu
interval = 30
# index = os
disabled = 0

sourcetype = hardware
source = hardware
interval = 36000
# index = os
disabled = 0

disabled = false
# index = os
interval = 86400
source = Unix:Version
sourcetype = Unix:Version

The problem is, that these are inputs for event metrics and everything else is set up for metrics!

In the actual Splunk_TA_nix, the inputs for metrics versions of those scripts have a different stanza, such as


If I simply change the sourcetype, it breaks the input, so by default, all those metrics based scripts output with the metric name using the _metric suffix.

Unfortunately, ALL the ITSI OS module searches are looking for the un suffixed metric names, E.G. cpu, ps, vmstat!

If I alter the searches to look for the updated suffixed metric names, I don't get the OS Host Information panel appearing on the entity within the deep dive or entity view.

So I don't know how, under the configured searches, any of this will work unless heavily modified, or why the documentation points to event log collection scripts  but the module requires metrics indexes given the use of mstats to search.

What am I missing here?

Labels (4)
0 Karma

Loves-to-Learn Lots

Noticed the same issue here.  There seems to be a discrepancy with how ITSI/IT Work does entity discovery.  Entity types appear to rely on metric data and entity discovery modules on event data.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...