I can't find that much information on how to install this add on. https://github.com/jruaux/mongodb-monitoring Splunk Server already has the app installed. I download the .tgz file from https://splunkbase.splunk.com/app/2957/#/details and extracted it in /splunkforwarder/etc/apps but I notice there is not setup.sh script in the folder. I know I have to configure data inputs for admin, collection stats and database stats. But how is this going to get recognized without installing the add on on the mongo instance? Thanks in Advance ... View more

I have the Splunk Add-On for Linux and Unix installed which enables the "PS" command. How can I monitor the tomcat service or some other service on multiple hosts for 5 minutes? This is what I have so far: host="server-*" source="ps" tomcat I would like to trigger an alarm whenever the tomcat service has been down for more than 5 minutes on any of the hosts that the query finds. ... View more

At my job whenever they set up a Splunk forwarder they add only one monitor. "/var/logs". Does anybody do it this way? Shouldn't we adding monitors with stanzas on the /SPLUNK_HOME/etc/system/local/intputs.conf ? We have forwarders installed on 29 servers. Our licence usage is currently at 8GB. Does this sound like its too much for the amount of servers? Thanks in Advance ... View more

I have set up an alarm to tell me when tomcat service is down. hosts="server" source="ps" tomcat | stats latest(_time) as latest by host That is what I have for my search. For the trigger I have set: search < 1. Sometimes I get false alarms. Am I missing something? Also at my job they used /var/logs directory... shouldn't we just use some tomcat directory just to monitor tomcat? Thanks in advance! ... View more