I run this query on the SHC SE 7.3.1.1 with SAI 2.0 and no results at all (last 7 days), so it looks like some processes are not running at all.
About environment: We do run one IDXC SE 7.3.1.1 with the SAI_TA 2.0 installed. We have one SHC SE 7.3.1.1 running the SAI 2.0 app, the one that this post is about. We have one SH SE 7.3.1.1 running ITSI 4.3.1 and as such SAI 1.4.1 and I do see now also the SAI-TA 1.4.1 installed. But regarding to docs the SAI-TA doesn't need to be on the SH's but only on indexers or heavy forwarders. Then we have a couple of HF SE 7.3.1.1 with the SAI-TA 2.0 installed and configured to use HEC with the following configuration:
[http://em_metrics]
connection_host = ip
disabled = 0
index = em_metrics
indexes = em_metrics
queueSize = 1MB
description = Metrics data for the Splunk App for Infrastructure
token = <here is a valid token>
sourcetype = em_metrics
The collectd agent is manually installed and configured according to the documentation.
On the ITSI SH this Linux server is visible within the investigate. But on the SHC (running SAI 2.0) not.
... View more