I wanted to have additional data sent to the indexer from the UF using the Splunk Add-On for NIX. I modified the script where it runs iostat -xk on the server to get avgrq-sz, r_await and w_await metrics. In the script I added the fields I wanted with descriptive names (although maybe I shouldn't have) and hoped that it would be displayed when I run the search index=os sourcetype=isostat. I can find the fields is I run the search index=os sourcetype=isostat | fields - avgrq-sz. If I tried to run it index=os sourcetype=isostat avgrq-sz>5 (test purposes) I get no events found. Eventually I would like to set this up as an alert to possible disk degradation.
Any assistance would be greatly appreciated. Thank you!
