Splunk Enterprise

Is there a way to format systeminfo.txt contained in diag to a form that can be seen in Splunk?

yutaka1005
Builder

I know that obviously I can obtain information in real time by getting information from the target Splunk server with an application such as add on for linux.

However, I want a function to know the system information of the target Splunk server by indexing diag file to another Splunk server.

If anyone has a good idea,
please tell me.

0 Karma

HiroshiSatoh
Champion

Diag can be imported into Splunk as it is. try it.

0 Karma

yutaka1005
Builder

Yeah I know diag can be imported as it is, and the internal type log is configured automatically in each appropriate sourcetypes, but systeminfo.txt is separated to each event complicatedly.

0 Karma

HiroshiSatoh
Champion

どんな情報を取得したいんですか?
sourcetype=systeminfo
で検索すれば情報がまとまっていると思いますが、どのように分離していますか?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...