We want to use ITSI with universal forwarders (windows and nix). Which is best practice, enable the metrics inputs in UF local or windows/nix add on local?
Enable the inputs in an app. Inputs in etc/system/local cannot be changed by the Deployment Server (DS). Using a DS is another best practice.
Thank you, @richgalloway. I have been tasked with taking over our Splunk instance that a former employee started and never finished.
I will transition the inputs to apps so that I can use a DS. One other thing. I see that the perfmon stanzas have "_meta = OS, OS version, IP, etc that are host specific. When using a DS, how can I populate that data?