https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-the-S-o-S-app-use-data-from-the-Windows-and-nix-TA-instead/m-p/28292#M960 <P>Scripted inputs 'lsof.sh' and 'ps.sh' from the *nix TA <EM>should</EM> be compatible with the S.o.S usage resource dashboards, as long as you change the 'set_sos_index' macro in <CODE>$SPLUNK_HOME/etc/apps/sos/local/macros.conf</CODE> and point it to the index where those scripted inputs are writing events - typically, the 'os' index. Do note, however, that some fixes and improvements we did to the <A href="http://splunk-base.splunk.com/apps/36662/splunk-on-splunk-sos-technology-add-on-for-unix-and-linux">S.o.S TA for *nix</A> scripted inputs will not be incorporated to the equivalent inputs in the *nix TA.</P> <P>The <A href="http://splunk-base.splunk.com/apps/57188/splunk-on-splunk-sos-technology-add-on-for-windows">S.o.S TA for Windows</A> provides a custom-made scripted input ('ps_sos.ps1') that gathers per-process resource usage with a format identical to that of 'ps.sh'. The Windows TA does <STRONG>not</STRONG> offer such a scripted input.</P> Wed, 08 May 2013 22:35:04 GMT hexx 2013-05-08T22:35:04Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-the-S-o-S-app-use-data-from-the-Windows-and-nix-TA-instead/m-p/28291#M959 <P>I already have the standard Windows TA and Unix TA why do I need to install the SOA TAs? Are they not compatible and if not why can't they be?</P> Wed, 08 May 2013 20:36:42 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-the-S-o-S-app-use-data-from-the-Windows-and-nix-TA-instead/m-p/28291#M959 hvandenb 2013-05-08T20:36:42Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-the-S-o-S-app-use-data-from-the-Windows-and-nix-TA-instead/m-p/28292#M960 <P>Scripted inputs 'lsof.sh' and 'ps.sh' from the *nix TA <EM>should</EM> be compatible with the S.o.S usage resource dashboards, as long as you change the 'set_sos_index' macro in <CODE>$SPLUNK_HOME/etc/apps/sos/local/macros.conf</CODE> and point it to the index where those scripted inputs are writing events - typically, the 'os' index. Do note, however, that some fixes and improvements we did to the <A href="http://splunk-base.splunk.com/apps/36662/splunk-on-splunk-sos-technology-add-on-for-unix-and-linux">S.o.S TA for *nix</A> scripted inputs will not be incorporated to the equivalent inputs in the *nix TA.</P> <P>The <A href="http://splunk-base.splunk.com/apps/57188/splunk-on-splunk-sos-technology-add-on-for-windows">S.o.S TA for Windows</A> provides a custom-made scripted input ('ps_sos.ps1') that gathers per-process resource usage with a format identical to that of 'ps.sh'. The Windows TA does <STRONG>not</STRONG> offer such a scripted input.</P> Wed, 08 May 2013 22:35:04 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-the-S-o-S-app-use-data-from-the-Windows-and-nix-TA-instead/m-p/28292#M960 hexx 2013-05-08T22:35:04Z