splunk/itsi-cp-starter-pack

itsi-cp-starter-pack's Issues

IT Essentials Work

Hey, I am trying to use IT Essentials for work and it is not populating entities for Windows. I have followed the troubleshooting steps in the guide (See Below). Splunk support has not helped at all. We are collecting Windows Events using a heavy forwarder and managing the Windows UF on the deployment server which is running on the Heavy Forwarder. Below is the error they are receiving. Not sure where to go from here. Can you provide any assistance related to this issue?

Search peer idx-i-0899cbe90e0a9b020.fortegra.splunkcloud.com has the following message: The metric event is not properly structured, source=CPU, sourcetype=CPU, host=JAX-OKTA-DEV, index=em_metrics. Metric event data without a metric name and properly formated numerical values are invalid and cannot be indexed. Ensure the input metric data is not malformed, have one or more keys of the form "metric_name:" (e.g..."metric_name:cpu.idle") with corresponding floating point values

Troubleshoot the Windows entity integration in ITSI - Splunk Documentation