Splunk Add-on for Unix and Linux not able to fetch "vmstat" data

Available Languages

Updated:September 29, 2026
Document ID:SPLK048884

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Splunk Cloud Splunk Add-on for Unix and Linux

Description

Splunk Add-on for Unix and Linux is not able to collect the vmstat data. Even though inputs are configured the add-on does not collect the data.


Investigation

-> Check the inputs that are configured to collect the vmstat data. 

-> The Splunk Add-on for Unix and Linux have multiple dependencies, that are mandatory to be installed for the proper functioning of the Add-on.

-> One of them is Sysstat package, which is required.  The script of the inputs of the App Unix and Linux ( vmstat.sh ) uses the shell command sar and if the package is not installed the scripts won't run. 

-> There are multiple mandatory dependencies, The Splunk Add-on for Unix and Linux requires these software packages to be installed on all supported Unix and Linux operating systems:

  • sysstat
  • ntpdate
  • lsof
  • nfs-utils
  • bash
  • chrony

 


Resolution

Make sure the Sysstat package is installed on the instance where the data collection is configured. 
Dependencies  

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products