How does the unix app work when enabled on multiple forwarders

[Chris_R_]

I have the unix app deployed to multiple forwarders and it's enabled, Will i have to do anything else on the forwarders/indexers to get these in the "os" index. Will the unix app data forwarded from the lightweight forwarders show up in all the unix app sourctypes, "lsof" "top" "df" etc etc... Have any other helpful config tips?

[hulahoop · Accepted solution]

On the indexing server, if you do not plan to enable the unix app, you will need to create an os index. Otherwise, all the data from your forwarders will not have a home and will not show up on the indexing server.

Additionally, you will want to make sure the scripted inputs for collecting data such as ps, top, lsof, etc. create sensible output when executed on your particular flavor of *nix. You can do this by running them manually. The scripts are located in $SPLUNK_HOME/etc/apps/unix/bin.

Also, make sure you are comfortable with the default execution intervals for the scripted inputs. The defaults range from every 30 seconds for ps.sh to every 10 hours for hardware.sh. The intervals can be changed by clicking on the "Configure Splunk 4 Unix" link on the App's homepage or by manually editing $SPLUNK_HOME/etc/apps/unix/default/inputs.conf. If manually editing inputs.conf, a restart of Splunk is required for changes to take effect.

Hope this helps!

[Jason]

Don't forget - best practice is to make a copy of $SPLUNK_HOME/etc/apps/unix/default/inputs.conf as $SPLUNK_HOME/etc/apps/unix/local/inputs.conf and make your changes there, so that they are not overwritten when the unix app is upgraded.