About Strunk

Strunk · ‎07-18-2014

Also see: http://answers.splunk.com/answers/134554/process-for-renaming-an-app

Strunk · ‎07-18-2014

I couldn't rename my deployed app just by changing the name of its directory. The deployment server kept failing to start after restarting splunk . I created a new barebones app, copied all of /local/ from the old app to the new app, disabled the old app, then deleted its directory. That worked okay for me.

Strunk · ‎07-17-2014

See this question: http://answers.splunk.com/answers/132477/adding-hosts-to-splunk-app-for-unix What worked for me was following those instructions to ensure each host was added to a group, which was then added to a category. I'm guessing that because I deployed the app to the universal forwarders/deployment clients after installing the app on the deployment server/index, the categories and groups weren't populated automatically.

Strunk · ‎07-17-2014

I'm having the same problem, with getting data back from universal forwarders. The data is making it to the indexer/deployment server, but it's not showing up in the dashboard.

Strunk · ‎07-16-2014

D'oh! Yes, I made the mistake; I thought I had installed the app on the indexer when I had only installed the add-on. Things are working as expected now, after installing the actual app.

Strunk · ‎07-16-2014

Why can't I see the Splunk App for Unix and Linux in Splunk Web? I installed the add-on to my deployment clients, and am trying to view the data with the app installed on my indexer. The installation appears to go okay and am prompted in Splunk Web to configure the app for the first time. However, that is all I'm able to view from the app, the configuration screen, not pretty graphs. 🙂 I've restarted my indexer several times, and I've confirmed that the universal forwarders (deployment clients) are sending data to the indexer, i.e., I can query the index ("os" in this case) directly and see data.

Strunk · ‎07-15-2014

So how would you tell the indexer to only apply a props/transforms to a particular monitor on a particular universal forwarder?

Strunk · ‎07-15-2014

For me, I had updated my outputs.conf with the correct hostname and port number but had not reloaded the universal forwarder to implement the changes. ./splunk restart worked for me.

Posts	8
Solutions	1
Karma Given	8
Karma Received	5
Member Since	‎07-11-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Can't see the Unix and Linux app after installing ...

Re: Rename an app

Re: Rename an app

Re: Splunk App for Unix not showing hosts from pee...

Re: Splunk App for Unix not showing hosts from pee...

Re: Can't see the Unix and Linux app after install...

Can't see the Unix and Linux app after installing ...

Re: Transforms and props files on splunk universa...

Re: How to activate forward-server?