Where do I find data being collected for CPU, RAM in Splunk Ent. Data Inputs for my Windows & Unix hosts? I need this as part of cutting the fat from the license usage. Is there a best practices document to trim such data that is either redundant or useless? Thank u
Check the inputs.conf files on your forwarders. Turn off the performance inputs you don't need and increase the interval for those you still want.
Thank u sir. What u described has to be done via CLI I have learned. I also have found the the same under settings-->Data Inputs for local & remote sources. But I can not do much editing of the values you are talking about right? Can the settings & values be all changed via GUI as well? Please advise.
Yes, you can use the GUI to change those settings, but if you have more than a couple of forwarders then all those clicks will be time consuming and error-prone. Better to make the changes to an app (using the CLI - it's not a four-letter word) on your DS and push the new settings from there.