|
Hi, I have installed splunk for unix app on splunk forwarder and it is working properly and it sends data to Splunk receiver.So is it possible to enable only CPU scripts and disable other scripts using CLI.Can you also recommend me links related to that issue? |
|
Those are mostly scripted inputs. You could disable them in the $SPLUNK_HOME/etc/apps/unix/local by copying the inputs.conf from $SPLUNK_HOME/etc/apps/unix/default/ and then setting disabled = 1 under each of the scripted inputs that you do not want to to see. I have put disabled=1 for all scripted inputs in the $SPLUNK_HOME/etc/apps/unix/local except for script cpu.sh where disabled=0.But when I make search in my splunk receiver, I don't see output from cpu.sh.But when I put disabled=0 for all scripted inputs ,I see all output from all scripted inputs.So why when I put disabled=0 for only cpu.sh,I don't see its output
(12 May '11, 05:18)
bwenge
What frequency with which you run this script? Perhaps the CPU script simply hasn't run again?
(12 May '11, 13:19)
jbsplunk ♦
|