Splunk ITSI

how to solve this error in Splunk-TA-nix

mitali
Explorer

message from "/opt/splunk/etc/apps/Splunk_TA_nix/bin/vmstat.sh" dmesg: read kernel buffer failed: Operation not permitted

Labels (1)
0 Karma

mitali
Explorer

From splunk_TA_Nix app few sourcetpye are missing like -sourcetype protocol is not excute in bin command sh protocol.sh  no data is showing .can you please let me what is the reason of missing sourcetype.

0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

This may be related to restricting kernel access on instances. You can try running the following command to lift the restrictions on the kernel.

kernel.dmesg_restrict = 0

To make this change persistent, you can save the above parameter in a conf file as below:

/etc/sysctl.conf

 OR 

cat /etc/sysctl.d/10-local.conf 

 

---
If you find the answer helpful, an upvote/karma is appreciated
Get Updates on the Splunk Community!

SOC Modernization: How Automation and Splunk SOAR are Shaping the Next-Gen Security ...

Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower ...

Ask It, Fix It: Faster Investigations with AI Assistant in Observability Cloud

  Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With ...

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...