Splunk Search

Search head core network, Free Disk, CPU used, memory free %... which index I use

htramtran83
Explorer

there are index =os and index=_internal .
Index=os, where there all info about OS performance data of servers (host), also host =ip*
index=_internal, there contain these OS data, but internal hosts.

Which index should I use?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The _internal index contains events Splunk writes about itself. For data about your servers, use index=os.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The _internal index contains events Splunk writes about itself. For data about your servers, use index=os.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!