Monitoring Splunk

Capturing CPU and Memory from remote Linux machine

rajeshm
Explorer

Hi

We have installed splunk 4.3.3 free version.

Want to monitor CPU and Memory of Linux server.What setting tobe done in inputs.conf file to monitor CPU and Memory...?

Regards

Rajesh

Tags (1)
0 Karma

whitewool
Splunk Employee
Splunk Employee

If you use a Universal Forwarder you will have to install Python libraries as it is a small footprint distribution and does not include any of the libs.

0 Karma

MHibbin
Influencer

depends what you want to do with the forwarder really, for example if they want the lightest solution.. they could install a universal forwarder and then have a bash script for the input, removing the requirement for python (as far as i'm aware) as it will use the systems bash shell (i.e. that's why you can't use bash scripts on Windows. I have linked the docs as in my answer as there are a few sections on what can and can't be done with each forwarder. 🙂

0 Karma

MHibbin
Influencer
0 Karma

MHibbin
Influencer

The best thing to do would be to install a Splunk forwarder on the remote machine (i.e. Light or universal forwarder), and then have a scripted input set up that runs a simple bash script to generate output for free -mt and something like mpstat or top. Splunk have release an App and/or add-on which captures this information and a lot more here.

Alternatively if you absolutely can not install a forwarder, you can use bash scripts to run remote commands, this will then be set up as a scripted input on your indexer (not the best method though).

Hope this helps,

MHibbin

brettcave
Builder

I can second - the *nix app works great, although across a large number of hosts it generates quite a bit of data. We modified the scripts and intervals to reduce the amount of indexed data used by the nix app.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...