However, so far, I can't derive anything meaningful for building the dashboards.
I would like to set Splunk to monitor the host operating systems logs files and/or performance data on macOS. I get data in from sources including '/var/log' and '/Library/Logs' but don't see anything meaningful from the data with certain field values filtered. I would also like to monitor the performance data but not sure where they locate at or how to filter the values. Any help would be appreciated! Thanks!
System Log Folder: /var/log
System Log: /var/log/system.log
Mac Analytics Data: /var/log/DiagnosticMessages
System Application Logs: /Library/Logs
System Reports: /Library/Logs/DiagnosticReports
User Application Logs: ~/Library/Logs (in other words, /Users/NAME/Library/Logs)
User Reports: ~/Library/Logs/DiagnosticReports (in other words, /Users/NAME/Library/Logs/DiagnosticReports)
For performance data, I assume I should monitor the cpu, ram, battery usage, etc. for creating meaningful dashboards? However, are there any logs for this performance data on macOS? If not, how should I get this data in from maybe Activity Monitor? Thanks!