Splunk on Splunk (S.o.S) add-on for Windows
Overview
Details
The Splunk on Splunk Add-on is a collection of inputs for the Splunk on Splunk (SoS) app - http://www.splunk.com/goto/sos
Important: You do not need to install the S.o.S add-on on a Splunk instance where the S.o.S app is already installed. The S.o.S app ships with the same data inputs.
What is this add-on for, then?
This S.o.S add-on allows you to pull in resource usage data from remote Splunk instances running on Windows for display in your existing instance of the Splunk on Splunk app. To enable this, install and configure this S.o.S add-on on Windows search-peers or forwarders to track the resource usage of Splunk.
NOTE: You must enable the data inputs included in this add-on before they can report resource usage information. By default, these inputs are disabled. Refer to the README file for more information.
For more details on how to set up S.o.S and its add-on to monitor Splunk's system resource usage, please refer to the following Splunk Answers:
- Best practices to deploy the S.o.S app in a distributed search environment
- How do I set up the S.o.S app to monitor Splunk's system resource consumption?
- How can I monitor the resource usage of my forwarder using the S.o.S app?
REQUIREMENTS:
- PowerShell version 2.0.
- Local PowerShell script execution must be enabled. See the README file for details.
- Splunk on Splunk app version 2.3 or higher is required to properly use the events produced by this add-on.
Release Notes
Version 2.3.4
Bugs fixed in version 2.3.4
- [SOS-11] Fixed an issue where ps_sos.ps1 would log many "WriteError" exceptions to splunkd.log and insert incorrect values in its events.
Version 2.3.3
Bugs fixed in version 2.3.3
-
[SUP-812] Fixed an issue where ps_sos.ps1 would often produce errors referencing calls to a method with a null-valued expression.
-
[SUP-845] Replaced all mentions of the S.o.S "technology add-on" with "add-on".
Version 2.3.2
Bugs fixed in version 2.3.2
-
[SUP-691] Fixed an issue where the ps_sos.ps1 scripted input produced format errors when trying to set $CMDLINE.
-
[SUP-718] Made the ps_sos.ps1 scripted input more resilient to errors.
Version 2.3.1
Fixed in version 2.3.1
-
[SUP-672] Added an index definition for 'sos_summary_daily index' to indexes.conf.
-
[SUP-616] Fixed an issue with the ps_sos.ps1 scripted input where memory usage would sometimes be recorded as a negative value.
-
[SUP-565] Fixed an issue where the ps_sos.ps1 scripted input would not run on an instance part of a search-head pool.
-
[SUP-541] Updated the app icon.