Splunk Search

How can I alter the searches being executed by *NIX app?

New Member

Based on other questions submited, it looks like I might be able to change the inputs.conf file but need to make sure.

what I want to do is limit the data pulled in on 'top' & 'ps'. I want to add " | HEAD 20". If I'm reading this right, I can add that command on the line following 'source = top' as I have below. is this correct? Is there a better way to accomplish this? any pointers would be appreciated.

interval = 60
sourcetype = top
| head 20 (<==== new entry)
source = top
index = os
disabled = 1

Tags (1)
0 Karma


What you're altering there isn't a search, it's an input stanza. So that syntax isn't going to do anything functional. If you want to modify what those scripts output, you'll need to go into $SPLUNK_HOME/etc/apps/unix/bin/ and then modify the relevant script.

As to what to change in the script to accomplish what you want, that depends on the platform. You're working with shell scripts there, not Splunk specific language.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...