Splunk® App for Unix and Linux

Install and Use the Splunk App for Unix and Linux

Download manual as PDF

Download topic as PDF

Troubleshoot the Splunk App for Unix and Linux

You can troubleshoot your Splunk App for Unix and Linux deployment if you are experiencing errors or if you are not seeing the data that you expect.

The bubble color differs from the actual value

The bubble in the chart shows the value of the selected parameter from the dropdowns. The color bar sets the color of the bubble, and the color bar shows a value between 1 to 100. If the bubble value is greater than 100, then the value is scaled to keep the number under 100.

Error about the unix_summary index when enabling alerts

This error occurs when you are running a version 5.2.1 or earlier of the Splunk App for Unix and Linux and have not distributed the indexes.conf file to all indexers in your instance. Alerts require this index to function correctly.

Missing or invalid dropdowns.csv

This error occurs when you skip the first-time configuration screen. Complete these two steps to fix it:

  1. Configure the app by selecting Settings from the main app menu.
  2. From the Settings screen, select Categories.

CPU information is not displaying

This error occurs when the sysstat package is not installed on the system that hosts the app. Use your system's package manager to install the package.

Ubuntu systems do not ship with this package by default. Run the following command to add it: apt-get install sysstat

Amazon EC2 Amazon Machine Image (AMI) systems also do not ship with this package installed by default. Run the following command to add it: yum -y install sysstat

Home and Metrics views do not display data

If your Home and Metrics views do not display any data, navigate to the web.conf file on the Splunk platform instance that runs the app and add the following stanza:

[settings]
minify_js = True

If you set minify_js to False, views do not load.

Split pctCPU

The value of pctCPU calculates across all CPU, and not per individual cores. Use searches such as the following to split pctCPU into smaller units:

Search Description

tag=cpu | stats avg(pctUser)

average cpu.user over all CPUs

tag=cpu | stats avg(pctUser) by CPU

average cpu.user per CPU

tag=cpu CPU=1 | stats avg(pctUser) by CPU

average cpu.user of CPU 1
PREVIOUS
Use the Alerts dashboard
  NEXT
Create custom alerts

This documentation applies to the following versions of Splunk® App for Unix and Linux: 5.2.4, 5.2.5


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters