All Apps and Add-ons

How does the unix app work when enabled on multiple forwarders

Splunk Employee
Splunk Employee

I have the unix app deployed to multiple forwarders and it's enabled, Will i have to do anything else on the forwarders/indexers to get these in the "os" index. Will the unix app data forwarded from the lightweight forwarders show up in all the unix app sourctypes, "lsof" "top" "df" etc etc... Have any other helpful config tips?

1 Solution

Splunk Employee
Splunk Employee

On the indexing server, if you do not plan to enable the unix app, you will need to create an os index. Otherwise, all the data from your forwarders will not have a home and will not show up on the indexing server.

Additionally, you will want to make sure the scripted inputs for collecting data such as ps, top, lsof, etc. create sensible output when executed on your particular flavor of *nix. You can do this by running them manually. The scripts are located in $SPLUNK_HOME/etc/apps/unix/bin.

Also, make sure you are comfortable with the default execution intervals for the scripted inputs. The defaults range from every 30 seconds for ps.sh to every 10 hours for hardware.sh. The intervals can be changed by clicking on the "Configure Splunk 4 Unix" link on the App's homepage or by manually editing $SPLUNK_HOME/etc/apps/unix/default/inputs.conf. If manually editing inputs.conf, a restart of Splunk is required for changes to take effect.

Hope this helps!

View solution in original post

Splunk Employee
Splunk Employee

On the indexing server, if you do not plan to enable the unix app, you will need to create an os index. Otherwise, all the data from your forwarders will not have a home and will not show up on the indexing server.

Additionally, you will want to make sure the scripted inputs for collecting data such as ps, top, lsof, etc. create sensible output when executed on your particular flavor of *nix. You can do this by running them manually. The scripts are located in $SPLUNK_HOME/etc/apps/unix/bin.

Also, make sure you are comfortable with the default execution intervals for the scripted inputs. The defaults range from every 30 seconds for ps.sh to every 10 hours for hardware.sh. The intervals can be changed by clicking on the "Configure Splunk 4 Unix" link on the App's homepage or by manually editing $SPLUNK_HOME/etc/apps/unix/default/inputs.conf. If manually editing inputs.conf, a restart of Splunk is required for changes to take effect.

Hope this helps!

View solution in original post

Motivator

Don't forget - best practice is to make a copy of $SPLUNK_HOME/etc/apps/unix/default/inputs.conf as $SPLUNK_HOME/etc/apps/unix/local/inputs.conf and make your changes there, so that they are not overwritten when the unix app is upgraded.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!