Getting Data In

Which is best practice, enable the metrics inputs in UF local or windows/nix add on local?

DeputyDawg
Engager

We want to use ITSI with universal forwarders (windows and nix).  Which is best practice, enable the metrics inputs in UF local or windows/nix add on local? 

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Enable the inputs in an app.  Inputs in etc/system/local cannot be changed by the Deployment Server (DS).  Using a DS is another best practice.

---
If this reply helps you, Karma would be appreciated.

DeputyDawg
Engager

Thank you, @richgalloway.  I have been tasked with taking over our Splunk instance that a former employee started and never finished.

I will transition the inputs to apps so that I can use a DS.  One other thing. I see that the perfmon stanzas have "_meta = OS, OS version, IP, etc that are host specific.   When using a DS, how can I populate that data? 

 

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...