message from "/opt/splunk/etc/apps/Splunk_TA_nix/bin/vmstat.sh" dmesg: read kernel buffer failed: Operation not permitted
From splunk_TA_Nix app few sourcetpye are missing like -sourcetype protocol is not excute in bin command sh protocol.sh no data is showing .can you please let me what is the reason of missing sourcetype.
This may be related to restricting kernel access on instances. You can try running the following command to lift the restrictions on the kernel.
kernel.dmesg_restrict = 0
To make this change persistent, you can save the above parameter in a conf file as below: