topic Need help configuring i/o to capture data from universal forwarders in Getting Data In

Need help configuring i/o to capture data from universal forwarders

jiaqya — Tue, 28 Nov 2017 18:42:54 GMT

looking to find a procedure or help to configure i/o so i can capture the same from universal forwarders.

currently the iostat source type is not showing any i/o for disk, but it shows only for cpu and mem.
can you guide me to set this up so i can collect disk i/o

thanks

Re: Need help configuring i/o to capture data from universal forwarders

ddrillic — Tue, 28 Nov 2017 23:35:32 GMT

Maybe it's disabled, like mine ; -)

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

Re: Need help configuring i/o to capture data from universal forwarders

woodcock — Wed, 29 Nov 2017 00:32:43 GMT

Go to your DS CLI and do this:

find /opt/splunk/etc/deployment-apps -type f -name inputs.conf -exec grep -il iostat {} \;

When you find the app (it could be one of several), make sure that there is a local directory and in there an inputs.conf file (if not, create them). Then copy the stanza header from the inputs.conf in the default directory (probably [script://./bin/iostat.sh]) and add disabled = 0 on the next line. Save it and then reload the configurations on DS to let it go out.

Re: Need help configuring i/o to capture data from universal forwarders

jiaqya — Sat, 02 Dec 2017 18:58:38 GMT

thanks that did the trick... 🙂