Hi @skrish91 You can use Splunk Add-on for Unix and Linux App. This Add-on includes hardware.sh (supports meminfo) and easy to use. https://splunkbase.splunk.com/app/833/ If you need customize or chooze specific fields, you can reuse hardware.sh or make your own shell scripts ( ex: using cat and awk commands and add a timestamp ) . Then, run your script with Script Inputs on the Universal Forwarder. Monitor Inputs watch the files and open it. It does not fit to watch under /proc folder files. /proc file is changing and overwrite realtime and there are no timestamp fields. ... View more

Hi @skrish91 Have a look at this : [perfmon://<name>] * This section explains possible settings for configuring the Windows Performance Monitor input. * Each perfmon:// stanza represents an individually configured performance monitoring input. If you configure the input through Splunk Web, then the value of "<NAME>" matches what was specified there. While you can add performance monitor inputs manually, Splunk recommends that you use Splunk Web to configure them, because it is easy to mistype the values for Performance Monitor objects, counters and instances. * NOTE: The perfmon stanza is for local systems ONLY. To define performance monitor inputs for remote machines, use wmi.conf. You can enable the perfmon you need and then add it to your inputs.conf file. Cheers, David ... View more

As everyone mentioned, change the server.conf files on Master and indexer nodes followed by a splunk restart of Master and then indexers https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Enableclustersindetail#Configure_the_security_key ... View more