All Apps and Add-ons

Splunk add-on for Unix and Linux - data not transformed

faustf
Communicator

Hi guys,
I've installed the Splunk App for Unix and Linux in my Splunk server (I've only 1 splunk server and N splunk universal forwarder).
On each forwarder I've installed the Splunk Add-on for Unix and Linux.
The data are are synchronized in the "os" index without problem.

But If I take a look at the data, I noticed that Splunk cannot extract the fields:

alt text

I checked the transforms.conf of the Splunk Add-on and I can see, for example, that a transformation for the CPU has been defined

#CPU    pctUser    pctNice  pctSystem  pctIowait    pctIdle
#all          1          0          1          ?         97
[fields_for_cpu_sh]
REGEX = all\s+(\d*\.*\d*)\s+(\d*\.*\d*)\s+(\d*\.*\d*)\s+(\d*\.*\d*)\s+(\d*\.*\d*)
FORMAT = pctUser::$1 pctNice::$2 pctSystem::$3 pctIowait::$4 pctIdle::$5

But it seems that it is not applied to my data.
I tried to search where the "fields_for_cpu_sh" is used in the configuration files but I couldn't find it (exception for the transforms.conf)

What am I missing?

thanks

0 Karma
1 Solution

faustf
Communicator

I figured out what was the problem:

I forgot to install the Unix Add-on on the indexer

View solution in original post

0 Karma

faustf
Communicator

I figured out what was the problem:

I forgot to install the Unix Add-on on the indexer

0 Karma

adonio
Ultra Champion

can you try and search in verbose mode?

0 Karma

faustf
Communicator

Thank for answering,
The output seems the same:
alt text

Maybe I'm mistaking, but shouldn't I find the string "fields_for_cpu_sh" in another configuration file?

For example, in my custom application I defined a transformation (MYTRANSFORMATION) in trasformations.conf , and in the props.conf file of my app I defined also:

[my-source-type]
REPORT-fields = MYTRANSFORMATION

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...