I'm setting up monitoring for my servers and in the 'Hosts" tab for Splunk App for *nix it asks "unknown - is cpu.sh enabled?" among other .sh's. looking at the query it tries to run, it shows: search index=<myindex> sourcetype=cpu host=<myindex> CPU="all" | append [stats count | eval _raw="no results" ] | eval used = 100 - pctIdle | eval name = "CPU:" | stats first(name) as name avg(used) as used sparkline(avg(used), 2m) as sl | eval used = round(used, 0) . "%" | fillnull used value="unknown - is cpu.sh enabled?" | fields sl When running index= sourcetype=cpu host=, this is the format: CPU pctUser pctNice pctSystem pctIowait pctIdle all 0.50 0.00 1.00 0.00 98.51 0 1.00 0.00 0.00 0.00 99.00 1 0.98 0.00 0.98 0.98 97.06 I can see that the stock query is not formatted in a way that likes the output of the forwarding server. Namely the CPU="all" part. How do i set up the index/sourcetype/etc. so it can be categorized correctly? Or if i can adjust the query to regex through accordingly. ... View more

Hello, I'm trying to set up some monitoring/dashboards for the infra in our team. I've installed Splunk App & Add-on for Infrastructure and it needs me to set up a HTTP Event Collector (HEC). However, when I go to set that up, it keeps giving me this error: "A token cannot have individual configuration for port." I'm following the steps here: https://docs.splunk.com/Documentation/Splunk/7.1.3/Data/UsetheHTTPEventCollector My global settings have tokens enabled, port set at 8088. (Although it says 'optional', i can't leave it blank because it keeps telling me "Parameter port: Ports must be numeric values.") How do I deal with the HEC error message so I can continue with collection? ... View more