how to configure new string for Linux servers CPU check,how to configure string to get logs of CPU usages of Linux hosts

[shobhna744]

I have index=os-icon-rhel and there are many sourcetypes are confirmed except CPU check. how to add sourcetype=CPU for the existing index=os-icon-rhel?

[soumyasaha25 · Accepted solution]

Hi @shobhna744, you can install the splunk TA for Unix and Linux from here , this would automatically parse your data and you should be able to see the cpu sourcetype in case you dont get the right sourcetype even after installing the TA you might have to check the props and transforms in the TA to figure out if they correctly map to your dataset.

you can have a look at the sourcetypes that ship along with the TA here.

Alternatively, you can define your own custom props and transforms rules to parse the data and assign sourcetype=cpu when the incoming data matches your conditions.

[shobhna744]

Thank you very much for your answer @soumyasaha25, I can see the suggested application by you Splunk Add-on for Unix and Linux (*nix) is already there in my application list. Also i can see for CPU it is showing me disabled in the current settings.Do i need to enable it for CPU on my splunk (version 6.5.1) ?