I've noticed an issue with the documentation and configuration for DA-ITSI-OS. https://docs.splunk.com/Documentation/ITSI/4.13.1/IModules/OSmoduleconfiguration Firstly, the documentation suggests that If using Splunk_TA_nix, I should enable metrics inputs with the following: [script://./bin/vmstat.sh] interval = 60 sourcetype = vmstat source = vmstat # index = os disabled = 0 [script://./bin/iostat.sh] interval = 60 sourcetype = iostat source = iostat # index = os disabled = 0 [script://./bin/nfsiostat.sh] interval = 60 sourcetype = nfsiostat source = nfsiostat # index = os disabled = 0 [script://./bin/ps.sh] interval = 30 sourcetype = ps source = ps # index = os disabled = 0 [script://./bin/bandwidth.sh] interval = 60 sourcetype = bandwidth source = bandwidth # index = os disabled = 0 [script://./bin/df.sh] interval = 300 sourcetype = df source = df # index = os disabled = 0 [script://./bin/cpu.sh] sourcetype = cpu source = cpu interval = 30 # index = os disabled = 0 [script://./bin/hardware.sh] sourcetype = hardware source = hardware interval = 36000 # index = os disabled = 0 [script://./bin/version.sh] disabled = false # index = os interval = 86400 source = Unix:Version sourcetype = Unix:Version The problem is, that these are inputs for event metrics and everything else is set up for metrics! In the actual Splunk_TA_nix, the inputs for metrics versions of those scripts have a different stanza, such as cpu_metric df_metric interfaces_metric iostat_metric ps_metric vmstat_metric If I simply change the sourcetype, it breaks the input, so by default, all those metrics based scripts output with the metric name using the _metric suffix. Unfortunately, ALL the ITSI OS module searches are looking for the un suffixed metric names, E.G. cpu, ps, vmstat! If I alter the searches to look for the updated suffixed metric names, I don't get the OS Host Information panel appearing on the entity within the deep dive or entity view. So I don't know how, under the configured searches, any of this will work unless heavily modified, or why the documentation points to event log collection scripts  but the module requires metrics indexes given the use of mstats to search. What am I missing here? ... View more

Hi, We're running a freshly installed installation of Enterprise (v 8.01) across: 3x Search Heads 3x Indexers (Rep factor 3, search 2) 1 Master, deployer and deployment server. I have installed Security Essentials, and deployed it to the search heads via the deployer (shcluster/apps folder) - and then run the Data Source Check (after first bookmarking a few items earlier). When the data source check is complete, I click on 'create posture dashboard' - which then allows me to select a number of reports based on User, network and Host. If I select some and click Create Dashboards, it appears to have done something - but clicking on the link for the dashboard, it results in a 404 (not found) error. I have checked permissions to the folder, and the Splunk server has read-write access. I have used the _bump method that we were advised to use by our support contacts. I am able to create and save dashboards within the app. I have logged directly into the search heads rather than via the Load balancer, and it makes no difference. I have removed and reinstalled the application a few times. I have updated the app to the very latest release available via SplunkBase. All hosts are Centos 7 ... View more

I have installed Splunk Security Essentials to our Splunk Enterprise 8.0 search head cluster, - and for some reason, although I can run through all the various dashboards to check for data, create bookmarks etc, when it comes to creating a posture dashboard for accounts, networks etc, it fails to create them and provides a dead link. I have checked permissions to the app folder on the hosts, but that all checks out. Am using the latest version on Splunk-base. ... View more

In short, we don't have direct access to our licensing server (it's being managed by our service provider) - but we still need to know what the volume of indexed data is each day. We do get a report from our service provider each day with licence usage data, but we want a dashboard doing the same. We found that running this SPL query: index="_internal" source="*metrics.log" per_index_thruput source="/opt/splunk/var/log/splunk/metrics.log" | eval gb=kb/1024/1024 | timechart span=1d sum(gb) as "Total Per Day" by series useother=f | fields - VALUE_* It sort of works, but the values we get are not matching the licence usage report we are getting. It's adding about 1/3rd more to the totals. We've got indexer and search head clusters (3 in each), splunk enterprise 8.0.0. Any advise appreciated! ... View more