Hello,
we had the Splunk_TA_nix running for some weeks now.
We are using the vmstat input and it worked as expected. But it stopped working.
Now only the header line is indexed. There is no data after that.
When I run the vmstat.sh under the same user (splunk) as the forwarder is running I get the header line and a line with data.
There are no errors in the _internal logs and nothing changed on the splunk enviroment that day (no restarts etc)
Do you have any ideas how to fix that?
↧