how to solve this error in Splunk-TA-nix

[mitali]

message from "/opt/splunk/etc/apps/Splunk_TA_nix/bin/vmstat.sh" dmesg: read kernel buffer failed: Operation not permitted

[mitali]

From splunk_TA_Nix app few sourcetpye are missing like -sourcetype protocol is not excute in bin command sh protocol.sh  no data is showing .can you please let me what is the reason of missing sourcetype.

[tshah-splunk]

This may be related to restricting kernel access on instances. You can try running the following command to lift the restrictions on the kernel.

kernel.dmesg_restrict = 0

To make this change persistent, you can save the above parameter in a conf file as below:

/etc/sysctl.conf

 OR 

cat /etc/sysctl.d/10-local.conf