I've noticed an issue with the documentation and configuration for DA-ITSI-OS.
https://docs.splunk.com/Documentation/ITSI/4.13.1/IModules/OSmoduleconfiguration
Firstly, the documentation suggests that If using Splunk_TA_nix, I should enable metrics inputs with the following:
[script://./bin/vmstat.sh]
interval = 60
sourcetype = vmstat
source = vmstat
# index = os
disabled = 0
[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
# index = os
disabled = 0
[script://./bin/nfsiostat.sh]
interval = 60
sourcetype = nfsiostat
source = nfsiostat
# index = os
disabled = 0
[script://./bin/ps.sh]
interval = 30
sourcetype = ps
source = ps
# index = os
disabled = 0
[script://./bin/bandwidth.sh]
interval = 60
sourcetype = bandwidth
source = bandwidth
# index = os
disabled = 0
[script://./bin/df.sh]
interval = 300
sourcetype = df
source = df
# index = os
disabled = 0
[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 30
# index = os
disabled = 0
[script://./bin/hardware.sh]
sourcetype = hardware
source = hardware
interval = 36000
# index = os
disabled = 0
[script://./bin/version.sh]
disabled = false
# index = os
interval = 86400
source = Unix:Version
sourcetype = Unix:Version
The problem is, that these are inputs for event metrics and everything else is set up for metrics!
In the actual Splunk_TA_nix, the inputs for metrics versions of those scripts have a different stanza, such as
cpu_metric
df_metric
interfaces_metric
iostat_metric
ps_metric
vmstat_metric
If I simply change the sourcetype, it breaks the input, so by default, all those metrics based scripts output with the metric name using the _metric suffix.
Unfortunately, ALL the ITSI OS module searches are looking for the un suffixed metric names, E.G. cpu, ps, vmstat!
If I alter the searches to look for the updated suffixed metric names, I don't get the OS Host Information panel appearing on the entity within the deep dive or entity view.
So I don't know how, under the configured searches, any of this will work unless heavily modified, or why the documentation points to event log collection scripts but the module requires metrics indexes given the use of mstats to search.
What am I missing here?
