You can enable platform instrumentation which will start populating the _introspection index (disabled by default on UF) by following these steps: http://docs.splunk.com/Documentation/Splunk/6.1.4/Troubleshooting/ConfigurePIF sourcetype=splunk_resource_usage should give you some insights into what you're looking for. ... View more

Thank you for the details, I plan to incorporate one of these strategies in my app. As far as the custom response handler class is concerned, since the documentation says to add the class to rest_ta/bin/responsehandlers.py, is there a way to include an additional file from my app? or programmatically add my code to the rest_ta after it is installed? ... View more