Running Splunk TA on SLES 11 SP1. I ran cpu.sh manually and did not receive any errors. I verified the script is enabled in inputs.conf. There is no data for sourcetype=cpu.
[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 300
index = os
disabled = 0
I was logged in as root.
It looks like my problem was that the sysstat package wasn't installed, although I thought I had verified that the paackage was installed and ran the cpu.sh.
I was missing the sar application.
I was logged in as root.
It looks like my problem was that the sysstat package wasn't installed, although I thought I had verified that the paackage was installed and ran the cpu.sh.
I was missing the sar application.
Yes, if you can run it manually then it might be related to permissions. What happens if you run $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/unix/bin/cpu.sh
? Also, do you see anything if you search for index=_internal sourcetype=splunkd execprocessor
or just searching for 'error'
OR 'cpu.sh'
in the splunkd sourcetype?
What user are you running Splunk as? If you try running cpu.sh as that user does it work?