All Apps and Add-ons

Splunk add-on for Unix and Linux - data not transformed

faustf
Communicator

Hi guys,
I've installed the Splunk App for Unix and Linux in my Splunk server (I've only 1 splunk server and N splunk universal forwarder).
On each forwarder I've installed the Splunk Add-on for Unix and Linux.
The data are are synchronized in the "os" index without problem.

But If I take a look at the data, I noticed that Splunk cannot extract the fields:

alt text

I checked the transforms.conf of the Splunk Add-on and I can see, for example, that a transformation for the CPU has been defined

#CPU    pctUser    pctNice  pctSystem  pctIowait    pctIdle
#all          1          0          1          ?         97
[fields_for_cpu_sh]
REGEX = all\s+(\d*\.*\d*)\s+(\d*\.*\d*)\s+(\d*\.*\d*)\s+(\d*\.*\d*)\s+(\d*\.*\d*)
FORMAT = pctUser::$1 pctNice::$2 pctSystem::$3 pctIowait::$4 pctIdle::$5

But it seems that it is not applied to my data.
I tried to search where the "fields_for_cpu_sh" is used in the configuration files but I couldn't find it (exception for the transforms.conf)

What am I missing?

thanks

0 Karma
1 Solution

faustf
Communicator

I figured out what was the problem:

I forgot to install the Unix Add-on on the indexer

View solution in original post

0 Karma

faustf
Communicator

I figured out what was the problem:

I forgot to install the Unix Add-on on the indexer

0 Karma

adonio
Ultra Champion

can you try and search in verbose mode?

0 Karma

faustf
Communicator

Thank for answering,
The output seems the same:
alt text

Maybe I'm mistaking, but shouldn't I find the string "fields_for_cpu_sh" in another configuration file?

For example, in my custom application I defined a transformation (MYTRANSFORMATION) in trasformations.conf , and in the props.conf file of my app I defined also:

[my-source-type]
REPORT-fields = MYTRANSFORMATION

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...