https://community.splunk.com/t5/Splunk-Search/Search-head-core-network-Free-Disk-CPU-used-memory-free-which/m-p/482634#M135198 <P>The <CODE>_internal</CODE> index contains events Splunk writes about itself. For data about your servers, use <CODE>index=os</CODE>.</P> Mon, 16 Sep 2019 20:00:27 GMT richgalloway 2019-09-16T20:00:27Z https://community.splunk.com/t5/Splunk-Search/Search-head-core-network-Free-Disk-CPU-used-memory-free-which/m-p/482633#M135197 <P>there are index =os and index=_internal .<BR /> Index=os, where there all info about OS performance data of servers (host), also host =ip*<BR /> index=_internal, there contain these OS data, but internal hosts. </P> <P>Which index should I use?</P> Wed, 30 Sep 2020 02:12:37 GMT https://community.splunk.com/t5/Splunk-Search/Search-head-core-network-Free-Disk-CPU-used-memory-free-which/m-p/482633#M135197 htramtran83 2020-09-30T02:12:37Z https://community.splunk.com/t5/Splunk-Search/Search-head-core-network-Free-Disk-CPU-used-memory-free-which/m-p/482634#M135198 <P>The <CODE>_internal</CODE> index contains events Splunk writes about itself. For data about your servers, use <CODE>index=os</CODE>.</P> Mon, 16 Sep 2019 20:00:27 GMT https://community.splunk.com/t5/Splunk-Search/Search-head-core-network-Free-Disk-CPU-used-memory-free-which/m-p/482634#M135198 richgalloway 2019-09-16T20:00:27Z