Thanks for the tips, though this answers half my question as i still need to build a custom script to pull the data due to the target servers limitation.At such, I can't use the /bin/cpu.sh. However, It seems that the default props.conf and transforms.conf from "Splunk Add-on for Unix and Linux" seems to be working it's magic as Splunk is able to interpret and format the _raw data that i have accordingly to what i wanted. New Script HEADER='CPU pctIdle' HEADERIZE="BEGIN {print \"$HEADER\"}" PRINTF='END {printf "%-3s %9.1f\n", CPU, pctIdle}' AWK=awk CMD='vmstat' PARSE_0='NR==3 {CPU="all"} NR==3 {pctIdle=$15}' ... View more

Hi Woodcock, based on our observations. We've tried to define both the full path and also the path you've seen in the script above. Unfortunately, both produced the same results. Also, apologies for the convoluted script, i'm still new to this ^_^l ... View more

Thanks for the suggestion, Peirano. Unfortunately, the target "Suse" server which our forwarder agents are currently installed does not support the "Mpstat" command. ... View more

We tried the default script yesterday, but unfortunately it isn't working. ... View more

The script i wrote resides in the bin folder of my testing app "/opt/splunk/etc/deployment-apps/testing/bin". It is being invoked by "/opt/splunk/etc/deployment-apps/testing/local" through the following inputs.conf stanza. [script://./bin/test1.sh] interval = 300 disabled = 1 index = test sourcetype = doms_test_cpu As for my outputs.conf (because we are running in a clustered enviroment) [indexer_discovery:idx_discovery] pass4SymmKey = xxx master_uri = xxx [tcpout:auto_lb_group] indexerDiscovery = idx_discovery autoLBFrequency = 30 forceTimebasedAutoLB = true useACK = true [indexer_discovery:prd_idx] pass4SymmKey = xxx master_uri = xxx [tcpout:auto_lb_group_prd] indexerDiscovery = prd_idx autoLBFrequency = 30 forceTimebasedAutoLB = true useACK = true [tcpout] defaultGroup = auto_lb_group_prd, auto_lb_group ... View more

This is currently being deployed via deployment-apps in my Cluster Master ... View more