Hi. I am on Splunk 6.4.1 with the Unix Add-on (5.2.3). I was wondering if anyone had similar issues or solutions to get the following OS data working on AIX servers : vmstat.sh --- I get no values (see log below) and I am receiving the following message. I am not sure what is making the script not work. What do you think might be the problem? SPLUNK LOG memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS MANUALLY RAN [server:splunk]/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin> ./vmstat.sh memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS awk: The field -11 cannot be less than 0. The input line number is 5. The source line number is 1. 2 . ps.sh / top.sh -- I am trying to get CPU by process and ps is not cutting it. Below says that splunk is running "0.8", but its actually running around 20% on the server (through top/topas). Has anyone tried getting data through the top/topas command from AIX? SPLUNK LOG 19136670 - 0.8 1-19:52:10 1.0 370340 347348 - A 9-20:11:23 splunkd --nodaemon_-p_8089__internal_exec_splunkd ... View more

Looking to see if this is possible or if there are any other alternatives. Goal: I am using tags as a search filter for role access and I am looking for an automated way to manage this. Servers may be decommissioned or new servers may pop up so I want to automate as much as possible. An example would be providing an application owners access to ONLY OS logs, web server logs, etc to their application only. Background: We have indexes for windows logs, unix logs, web server logs, etc, so we cannot have separate indexes for applications. We have an automated job to produce a csv from our CMDB that tells us what application is mapped to which server, so how can we use that to auto-tag? ... View more