Hi All
I have a forwarder watching /var/log on a AWS linux machine, and I can see the logs in the Splunk Cloud Sandbox. Now I want to add monitoring of the linux box, CPU, memory, etc.
I have unarchived splunk-add-on-for-unix-and-linux_512.tgz in /opt/splunkforwarder/etc/apps/ (where /Splunk_TA_nix is created) and restarted the forwarder.
I'm wondering how I can configure the various metrics sent to my Splunk Cloud (sandbox) instance, and how do I access the data in the web GUI?
In the Splunk web interface I'm getting the following error:
received event for unconfigured/disabled/deleted index='os' with source='source::/var/log/auth.log' host='host::ip-x-x-x-x' sourcetype='sourcetype::syslog' (1 missing total)
I do not know if it is related (but I didn't get it previously).
In general I'm missing a good how-to guide, that tells me how the Splunk Cloud setup works, for instance how the apps installed on the forwarder interacts with the Cloud, and how they are configured.
Also all my configurations on the forwarder must be done using CLI from automated (ansible) scripts.
/Klaus
