A very interesting thread at - Changing UF outputs.conf using deployment server It says - usual method is to : • create an app in the deployment server in .../etc//deployment-apps//default/outputs.conf • define a serverclass.conf on the deployment server (to match clients to apps) • configure the forwarders to point to the deployment-server in deploymentclient.conf see http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Aboutdeploymentserver only potential hiccup, if your existing outputs.conf is already in /etc/system/local, then it will have precedence on the one in the deployed app, so move it away first. ... View more

I would recommend using the "Splunk Add-on for Unix" app. It has many scripted inputs that can be turned on via the inputs.conf to collect such performance and usage data. (https://splunkbase.splunk.com/app/833/#/overview) I would also like to note if you are going to use this on many UFs it is recommended that you use a deployment server to mange the app. ... View more

Thank you! ... View more