You need to increase the "monitoring_calculation_window" for in "collectors.conf" and restart Splunk.
If its Linux entity - increase the "os" stanza
For Windows - increase the "perfmon" stanza
Data is coming every 5 minutes (300 sec), I will keep the value between 450 to 600. This will make sure that SAI searches last 450-600 sec in past for the latest data.
... View more
You need Processor.* metrics for Windows entity discovery. Are they disabled in your inputs.conf.
monitoring_calculation_window is how many seconds to look in past for the new entity. It was set to 90 sec. If there is some data lag of more than 90 sec, entity won't be discovered. Solution is to increase this number if not working for you.
... View more
Can you answer some questions:
Do you see Processor.* metrics for your Windows hosts?
For this search on windows host, what is latest timestamp with data? (last data was 1min , 2min or 3min ago when you run the search? 😞 | mstats avg(_value) WHERE metric_name=Processor.%_Idle_Time AND index=em_metrics AND host=mywindows* span=30s
What version of SAI do you have?
... View more
If you are using Splunk Add-on for Linux and Unix, it has to be converted to metrics format using props.conf and transforms.conf and then indexed to Splunk's metrics index.
... View more
There are two types of data collected: Logs & Metrics.
Windows : Logs --> Splunk UF
Windows : Metrics -->Splunk UF (perfmon inputs.conf)
Linux: Logs --> Splunk UF (same as Windows)
Linux: Metrics --> Collectd
Metrics is required for entity discovery in SAI.
... View more
hi,
You are mixing up windows and linux data collection.
"perfmon" inputs in UF is only for Windows metrics.
You need to have "collectd" installed for Linux metrics. Splunk UF only forwards logs for Linux machines. What version of collectd do you have?
Also, you don't need SAI add-on on UF.
... View more
Not a big issue.. SAI just adds some extra dimensions like os_version and it could not find it for your machine..
You can also add it in collectd.conf manually if you really need it.
... View more
SAI was looking 90sec in past to see if any new entities was found. For some reason, your Machine 2 and Machine 3 has data lag of more than 90 sec. That's why we doubled the time to 180sec. You can keep it at 180s without issues. It shows inactive when it didn't see any new data in the monitoring window..
Maybe figure why there is lag as well and fix it as well...
... View more
This might be due to lag in data coming in ..
Can you try to update collectors.conf in SAI?
Change the "monitoring_calculation_window" to 180 for "os" and restart Splunk..
... View more
Metrics data is sent by collectd not UF for Linux machines..
So, I guess you ran the "Add Data" script on 3 machines and you only see 1 entity. But, you have metrics data from all 3 machines?
... View more