All Apps and Add-ons

splunk for unix

Explorer

Hi,

I have installed splunk for unix app on splunk forwarder and it is working properly and it sends data to Splunk receiver.So is it possible to enable only CPU scripts and disable other scripts using CLI.Can you also recommend me links related to that issue?

0 Karma

Splunk Employee
Splunk Employee

Those are mostly scripted inputs. You could disable them in the $SPLUNK_HOME/etc/apps/unix/local by copying the inputs.conf from $SPLUNK_HOME/etc/apps/unix/default/ and then setting disabled = 1 under each of the scripted inputs that you do not want to to see.

0 Karma

Splunk Employee
Splunk Employee

What frequency with which you run this script? Perhaps the CPU script simply hasn't run again?

0 Karma

Explorer

I have put disabled=1 for all scripted inputs in the $SPLUNK_HOME/etc/apps/unix/local except for script cpu.sh where disabled=0.But when I make search in my splunk receiver, I don't see output from cpu.sh.But when I put disabled=0 for all scripted inputs ,I see all output from all scripted inputs.So why when I put disabled=0 for only cpu.sh,I don't see its output

0 Karma