Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: no unix folder under /opt/splunk/etc/apps
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I installed "Splunk app for unix" by searching unix from "Find more apps" menu, based on the following instruction: http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux
And trying to copy /opt/splunk/etc/apps/unix according to the Step 8, because I hope my server(installed an indexer-instance of splunk) to be forwarded CPU/memory load (only two, not others) log data from other machines, but unable to find any folder named unix.
Is this the only way I could specify data I want them to be forwarded? Can I write a script into ~local/input (many from the forwarder not indexer) to specify data file related to CPU and memory load only, skipping copying ~/unix folder to the forwarder?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like that is an old post.
In the apps folder you will find 3 unix app components:
SA-nix
splunk_app_for_nix
Splunk_TA_nix
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like that is an old post.
In the apps folder you will find 3 unix app components:
SA-nix
splunk_app_for_nix
Splunk_TA_nix
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I expect you only need to transfer/copy the ones that contain inputs.conf files, but it would not hurt to transfer them all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks fount it, and does this mean I should copy all of those three to the forwarder. right?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
