All Apps and Add-ons

splunk for unix

bwenge
Explorer

Hi,

I have installed splunk for unix app on splunk forwarder and it is working properly and it sends data to Splunk receiver.So is it possible to enable only CPU scripts and disable other scripts using CLI.Can you also recommend me links related to that issue?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Those are mostly scripted inputs. You could disable them in the $SPLUNK_HOME/etc/apps/unix/local by copying the inputs.conf from $SPLUNK_HOME/etc/apps/unix/default/ and then setting disabled = 1 under each of the scripted inputs that you do not want to to see.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

What frequency with which you run this script? Perhaps the CPU script simply hasn't run again?

0 Karma

bwenge
Explorer

I have put disabled=1 for all scripted inputs in the $SPLUNK_HOME/etc/apps/unix/local except for script cpu.sh where disabled=0.But when I make search in my splunk receiver, I don't see output from cpu.sh.But when I put disabled=0 for all scripted inputs ,I see all output from all scripted inputs.So why when I put disabled=0 for only cpu.sh,I don't see its output

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...