All Apps and Add-ons script modification help


I wanted to have additional data sent to the indexer from the UF using the Splunk Add-On for NIX. I modified the script where it runs iostat -xk on the server to get avgrq-sz, r_await and w_await metrics. In the script I added the fields I wanted with descriptive names (although maybe I shouldn't have) and hoped that it would be displayed when I run the search index=os sourcetype=isostat. I can find the fields is I run the search index=os sourcetype=isostat | fields - avgrq-sz. If I tried to run it index=os sourcetype=isostat avgrq-sz>5 (test purposes) I get no events found. Eventually I would like to set this up as an alert to possible disk degradation.

Any assistance would be greatly appreciated. Thank you!

0 Karma

Ultra Champion

sample logs please.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...