topic Re: Where do I find data being collected for CPU, RAM in Splunk Ent. Data Inputs for my Windows & Unix hosts? in Getting Data In

Where do I find data being collected for CPU, RAM in Splunk Ent. Data Inputs for my Windows & Unix hosts?

SamHTexas — Thu, 29 Apr 2021 16:56:01 GMT

Where do I find data being collected for CPU, RAM in Splunk Ent. Data Inputs for my Windows & Unix hosts? I need this as part of cutting the fat from the license usage. Is there a best practices document to trim such data that is either redundant or useless? Thank u

Re: Where do I find data being collected for CPU, RAM in Splunk Ent. Data Inputs for my Windows & Unix hosts?

richgalloway — Thu, 29 Apr 2021 18:48:48 GMT

Check the inputs.conf files on your forwarders. Turn off the performance inputs you don't need and increase the interval for those you still want.

Re: Where do I find data being collected for CPU, RAM in Splunk Ent. Data Inputs for my Windows & Unix hosts?

SamHTexas — Thu, 29 Apr 2021 19:07:43 GMT

Thank u sir. What u described has to be done via CLI I have learned. I also have found the the same under settings-->Data Inputs for local & remote sources. But I can not do much editing of the values you are talking about right? Can the settings & values be all changed via GUI as well? Please advise.

Re: Where do I find data being collected for CPU, RAM in Splunk Ent. Data Inputs for my Windows & Unix hosts?

richgalloway — Fri, 30 Apr 2021 00:10:24 GMT

Yes, you can use the GUI to change those settings, but if you have more than a couple of forwarders then all those clicks will be time consuming and error-prone. Better to make the changes to an app (using the CLI - it's not a four-letter word) on your DS and push the new settings from there.