https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52805#M587 <P>The best thing to do would be to install a Splunk forwarder on the remote machine (i.e. <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Typesofforwarders">Light or universal forwarder</A>), and then have a <A href="http://docs.splunk.com/Documentation/Splunk/latest/Developer/ScriptSetup">scripted input</A> set up that runs a simple bash script to generate output for <CODE>free -mt</CODE> and something like <CODE>mpstat</CODE> or <CODE>top</CODE>. Splunk have release an <A href="http://splunk-base.splunk.com/apps/33800/splunk-for-unix-and-linux-technology-add-on">App</A> and/or <A href="http://splunk-base.splunk.com/apps/22314/splunk-for-unix-and-linux">add-on</A> which captures this information and a lot more here.</P> <P>Alternatively if you absolutely can not install a forwarder, you can use <A href="http://stackoverflow.com/questions/305035/how-to-use-ssh-to-run-shell-script-on-a-remote-machine">bash scripts to run remote commands</A>, this will then be set up as a scripted input on your indexer (not the best method though).</P> <P>Hope this helps,</P> <P>MHibbin</P> Thu, 06 Sep 2012 10:06:00 GMT MHibbin 2012-09-06T10:06:00Z https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52804#M586 <P>Hi</P> <P>We have installed splunk 4.3.3 free version.</P> <P>Want to monitor CPU and Memory of Linux server.What setting tobe done in inputs.conf file to monitor CPU and Memory...?</P> <P>Regards</P> <P>Rajesh</P> Thu, 06 Sep 2012 09:57:08 GMT https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52804#M586 rajeshm 2012-09-06T09:57:08Z https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52805#M587 <P>The best thing to do would be to install a Splunk forwarder on the remote machine (i.e. <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Typesofforwarders">Light or universal forwarder</A>), and then have a <A href="http://docs.splunk.com/Documentation/Splunk/latest/Developer/ScriptSetup">scripted input</A> set up that runs a simple bash script to generate output for <CODE>free -mt</CODE> and something like <CODE>mpstat</CODE> or <CODE>top</CODE>. Splunk have release an <A href="http://splunk-base.splunk.com/apps/33800/splunk-for-unix-and-linux-technology-add-on">App</A> and/or <A href="http://splunk-base.splunk.com/apps/22314/splunk-for-unix-and-linux">add-on</A> which captures this information and a lot more here.</P> <P>Alternatively if you absolutely can not install a forwarder, you can use <A href="http://stackoverflow.com/questions/305035/how-to-use-ssh-to-run-shell-script-on-a-remote-machine">bash scripts to run remote commands</A>, this will then be set up as a scripted input on your indexer (not the best method though).</P> <P>Hope this helps,</P> <P>MHibbin</P> Thu, 06 Sep 2012 10:06:00 GMT https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52805#M587 MHibbin 2012-09-06T10:06:00Z https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52806#M588 <P>I can second - the *nix app works great, although across a large number of hosts it generates quite a bit of data. We modified the scripts and intervals to reduce the amount of indexed data used by the nix app.</P> Thu, 06 Sep 2012 10:17:54 GMT https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52806#M588 brettcave 2012-09-06T10:17:54Z https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52807#M589 <P>If you use a Universal Forwarder you will have to install Python libraries as it is a small footprint distribution and does not include any of the libs.</P> Thu, 06 Sep 2012 12:24:00 GMT https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52807#M589 whitewool 2012-09-06T12:24:00Z https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52808#M590 <P><A href="http://splunk-base.splunk.com/answers/40348/universal-forwarder-scheduled-a-script-input">http://splunk-base.splunk.com/answers/40348/universal-forwarder-scheduled-a-script-input</A></P> Thu, 06 Sep 2012 12:31:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52808#M590 MHibbin 2012-09-06T12:31:53Z https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52809#M591 <P>depends what you want to do with the forwarder really, for example if they want the lightest solution.. they could install a universal forwarder and then have a bash script for the input, removing the requirement for python (as far as i'm aware) as it will use the systems bash shell (i.e. that's why you can't use bash scripts on Windows. I have linked the docs as in my answer as there are a few sections on what can and can't be done with each forwarder. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 06 Sep 2012 12:35:06 GMT https://community.splunk.com/t5/Monitoring-Splunk/Capturing-CPU-and-Memory-from-remote-Linux-machine/m-p/52809#M591 MHibbin 2012-09-06T12:35:06Z