- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: how to configure new string for Linux servers ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have index=os-icon-rhel and there are many sourcetypes are confirmed except CPU check. how to add sourcetype=CPU for the existing index=os-icon-rhel?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @shobhna744, you can install the splunk TA for Unix and Linux from here , this would automatically parse your data and you should be able to see the cpu sourcetype in case you dont get the right sourcetype even after installing the TA you might have to check the props and transforms in the TA to figure out if they correctly map to your dataset.
you can have a look at the sourcetypes that ship along with the TA here.
Alternatively, you can define your own custom props and transforms rules to parse the data and assign sourcetype=cpu when the incoming data matches your conditions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @shobhna744, you can install the splunk TA for Unix and Linux from here , this would automatically parse your data and you should be able to see the cpu sourcetype in case you dont get the right sourcetype even after installing the TA you might have to check the props and transforms in the TA to figure out if they correctly map to your dataset.
you can have a look at the sourcetypes that ship along with the TA here.
Alternatively, you can define your own custom props and transforms rules to parse the data and assign sourcetype=cpu when the incoming data matches your conditions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much for your answer @soumyasaha25, I can see the suggested application by you Splunk Add-on for Unix and Linux (*nix) is already there in my application list. Also i can see for CPU it is showing me disabled in the current settings.Do i need to enable it for CPU on my splunk (version 6.5.1) ?
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
Detecting Remote Code Executions With the Splunk Threat Research Team
