Top Header cpu & memory status

I didn’t like the CPU input from the Splunk TA Nix app, so I created this small ingest from top. The script takes a snapshot of the top command, and looks directly at the header:

and comes back with the first 5 lines of Top:

and the following query pulls CPU load average data […]

Continue Reading →

Show uptime in Days

The following query shows uptime of all systems over a certain period of time (days_uptime). Replace my indexes w/ yours.

  Looks like: hostname | DaysUP | Years | Months | SystemUpTime and $days_uptime$ is a text box in my case.

Continue Reading →

Search to show what apps are ready to be updated

If that Splunk has internet access, it’ll have the

fields filled with the latest version if there is an update available for any app installed on that system. The

filter should be usable for querying search peers as well. Using that scheduled daily or weekly, you could alert yourself of any update. […]

Continue Reading →

Permissions for splunk users

Another view for which splunk user can do what in your splunk environment

Continue Reading →