@jaxjohnny I know this is way late, and you probably have your answer now, but I used the above set of visio stencils in lucidchart, and I was able to double-click on the labels and then either remove them completely, or type in my own labels for my diagram.
... View more
Yes, I looked at the Metricator version of the apps, but they are not certified for Splunk Cloud. In my experience, Splunk Support generally will not install apps in Splunk Cloud that are not certified as such (and I'm almost certain they won't allow me to self-install apps that are not certified).
To answer your questions:
Question 1: What are the reasons why you use the cold data scenario ?
Pretty much because the other developer who installed nmon was already familiar with it and he did so, and we initially started reviewing the results manually. Later we decided to try to get the logs into Splunk for easier analysis. This is not to say that we couldn't change the way we're collecting nmon data, I was just trying to find a way to avoid doing that.
Question 2: Did you deploy the TA-nmon on the box that is monitoring the directory ?
Yes, the TA-nmon is deployed on that box.
I will explore your answer a bit, including the unarchive stuff, and will also work with the other devloper to see about changing up the way we run it.
Thank you for your quick response, Guilhem!
... View more
I am trying to following the instructions on the nmon performance monitor splunk app for unix and linux documentation (I don't have enough karma points to post the link, apparently, so the below link may not show):
Anyway, I am on the "Deploy to Splunk Cloud" page in the documentation, looking at the deployment matrix. I have:
Name: NMON Performance by Octamis
Self-service installed on Splunk Cloud with install location of Search Heads and Indexers (I did not specify the location, it just installed there).
Self-service installed on Splunk Cloud with install location of Search Heads and Indexers.
Name: Splunk_TA_nmon deployed to a linux box via the deployment server.
I have a custom inputs.conf defined on that same host in a local directory that has this:
disabled = false
whitelist = \.nmon$
index = nmon
sourcetype = nmon_processing
(stolen mostly from the "Indexing Nmon data generated out of Splunk" section on the page after "Deploy to Splunk Cloud")
Finally, I created the nmon index in Splunk Cloud. I do have data going into Splunk Cloud, but that data just looks like raw text and is not being parsed in the ways that it apparently needs to be in order for the NMON app dashboards to work as expected.
I did not configure nmon on the server (another developer did that) - is there some special way that has to be done in order for all of this to work? Am I missing some step to generate data models or something like that?
I know that Guilhem Marchand visits these forums and answers a lot of NMON questions, so hopefully this question will attract his attention! Of course, I am happy to receive help from anyone else who has gotten this working for Splunk Cloud!
... View more