cpu.sh diffent log format

[stenbryggen]

cpu.sh logs are different from universalforwarder then splunk installations.

Splunk is adding a line for all and each cpu, but the universalforwarder is adding everything in one log entry. And the "Hosts" dashboard can't understand the combined logs from the universalforwarder.

What can I do to fix this issue?

[araitz]

I'm not sure I understand. We use the universal forwarder to run the *nix TA, and there is fundamentaly no difference between the output from UF and from our indexers. My guess is that you don't have the TA installed on the search head, which is required so that muliti kv mode is enabled by default. See a similar issue here:

http://answers.splunk.com/answers/129893/splunk-app-for-unix-homemetrics-empty