Splunk Search

how to configure new string for Linux servers CPU check,how to configure string to get logs of CPU usages of Linux hosts

shobhna744
New Member

I have index=os-icon-rhel and there are many sourcetypes are confirmed except CPU check. how to add sourcetype=CPU for the existing index=os-icon-rhel?

0 Karma
1 Solution

soumyasaha25
Contributor

Hi @shobhna744, you can install the splunk TA for Unix and Linux from here , this would automatically parse your data and you should be able to see the cpu sourcetype in case you dont get the right sourcetype even after installing the TA you might have to check the props and transforms in the TA to figure out if they correctly map to your dataset.

you can have a look at the sourcetypes that ship along with the TA here.

Alternatively, you can define your own custom props and transforms rules to parse the data and assign sourcetype=cpu when the incoming data matches your conditions.

View solution in original post

0 Karma

soumyasaha25
Contributor

Hi @shobhna744, you can install the splunk TA for Unix and Linux from here , this would automatically parse your data and you should be able to see the cpu sourcetype in case you dont get the right sourcetype even after installing the TA you might have to check the props and transforms in the TA to figure out if they correctly map to your dataset.

you can have a look at the sourcetypes that ship along with the TA here.

Alternatively, you can define your own custom props and transforms rules to parse the data and assign sourcetype=cpu when the incoming data matches your conditions.

0 Karma

shobhna744
New Member

Thank you very much for your answer @soumyasaha25, I can see the suggested application by you Splunk Add-on for Unix and Linux (*nix) is already there in my application list. Also i can see for CPU it is showing me disabled in the current settings.Do i need to enable it for CPU on my splunk (version 6.5.1) ?

0 Karma
Get Updates on the Splunk Community!

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...