All Apps and Add-ons

Why does the Splunk App for Unix and Linux not show CPU usage on Ubuntu?

konstantin_zsen
Path Finder

Hi,

I have installed the Splunk App for Unix and Linux, enabled cpu.sh, and installed sysstat package. Also, I have added to inputs.conf (.../etc/system/local/) the following stanza:

[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 300
index = os
disabled = 0

But "CPU Used By Group" in the Splunk App for Unix shows "No Results Found".

In S.o.S I can see CPU usage.

Thank you for any help.

0 Karma

Amandeepsin
New Member

Hi,

You need to install sysstat package in linux as it doesn't come preloded with it.. Additionally, you have to make following changes in web.conf file

[settings]
minify_js = True

Restart service. It should work fine

0 Karma

lloydknight
Builder

Have you checked the permission of the cpu.sh script? The script should be in executable permission. Also check the splunkd.log for errors.

Hope it helps!

Thanks!

0 Karma

johnsplunk01
New Member

This issue is not caused by the Splunk_TA_nix addon app. I do see both cpu and mem data coming in to the splunk enterprise/monitoring instance when doing a preview in the splunk_app_for_nix settings tab.

It appears to be an issue with the splunk_app_for_nix application itself, not being able to interpret or read the incoming data for cpu and mem. The metrics tab on splunk_app_for_nix is also blank.

0 Karma

johnsplunk01
New Member

I am having the same issue. The cpu and mem shows NONE under the Hosts Tab. Were you able to resolve this issue?

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @johnsplunk01, Please use the comment button when leaving a comment! I went ahead and converted this one from an answer to a comment.

0 Karma

konstantin_zsen
Path Finder

cpu.sh works perfectly when I run ones manually under root.

0 Karma

konstantin_zsen
Path Finder

Follow searches returns results:
index=os sourcetype=os host=ubuntu
index=os sourcetype=top host=ubuntu

This example also return results - "index=os sourcetype=top host=ubuntu | chart avg(pctCPU) as avgCPU avg(pctMEM) as avgMEM by _time".

Splunk App for Unix does not see cpu.
I'm slightly disappointed.

0 Karma

konstantin_zsen
Path Finder

May be my problem related with permissions?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...