Get Monitoring Tricks for All Your *nix Part 1

[melissap]

View our first IT Edition Tech Talk, Get Monitoring Tricks for All Your *nix Part 1  to see an introduction to the *nix Technical Add-on (TA), showing you how you can gain rapid insights and operational visibility into Unix and Linux environments. 

Tune in for:

• An introduction to the TA
• A walk through demo showing set-up and available out-of-the-box content

Check out our *nix conversations in Splunk Answers community for more!

[melissap]

Hey everyone! We had some great questions during this Tech Talk in June. 

Recapping for all!

Q: What is the difference between this add-on and the Splunk app\ add-on for Infrastructure which also includes Linux \ Unix monitoring?

A: This TA collects data via shell scripts, and creates Splunk events. The add for infrastructure collects data via a collected agent and the data lands in Splunk as a metric.

Q: Does the Nix TA put performance data into a metrics type index?

A: This nix TA puts data into a Splunk index as an event, not a metric.

Q: So should we move this data to the index of our choice or should we keep it in main?

A: It's best to move this data to an index of your choice.

Q: So we would do that in the input.conf of the Splunk_nix_ta folder. Correct?

A: Correct! When you create the inputs.conf in your local folder, make sure to include the index=[your index] field under each input stanza.

Q: When we refer pctCPU, how do we segregate if it's for 1 core or 12 core or 24 core?

A: The cpu data comes in with one event per core, and another event that is an aggregate of all cores. 

[melissap]

Here are all the follow up materials from the webinar. Enjoy!

• Splunkbase Add-on for Unix and Linux

• Documentation –

Data Collection

Script Compatibility

Sourcetypes

Deployment

• Splunk Answers: *nix community posts

[zpravaiz]

Hi, I cannot register with these tech talks as drop-down fields show no data.  How can I access these talks?

[melissap]

Hi @zpravaiz - In the drop down for Select Your Session - check mark OnDemand and then submit, you will then be given the link to the ondemand version. Thanks!