Index iostat data using nix

[camah4]

Hi,

We collect sar/iostat data on our servers which are written to files. I would like to view the data collected in splunk using nix. At the moment we rsync the files from our production system to our internal systems for monitoring. I would like to have our internal splunk system index this data and view it using nix. Is this possible given our current configuration.

Thanks

[araitz · Accepted solution]

Sure, you will just need to have Splunk index the sar/iostat output files with the same sourcetype as the unix app is expecting (e.g. sourcetype=sar, sourcetype=iostat). You will also need to ensure that field extractions are consistent between the default unix extractions and your data.