Install the Content Pack for Unix Dashboards and Reports

Perform the following high-level steps to install the Content Pack for Unix Dashboards and Reports:

1. Install and configure the Splunk Add-on for Unix and Linux.
2. Install the Content Pack for Unix Dashboards and Reports.
3. Create indexes.

Prerequisite

Install and configure the IT Service Intelligence (ITSI) or IT Essentials Work App in your environment. See About Splunk ITSI in the Install and Upgrade Manual, or Install IT Essentials Work in the Overview of Splunk IT Essentials Work manual.

Install and configure the Splunk Add-on for Unix and Linux

The Content Pack for Unix Dashboards and Reports relies on data collected by the Splunk Add-on for Unix and Linux.

To learn more about how to enable inputs in the Splunk Add-on for Unix and Linux, see Enable data and scripted inputs for the Splunk Add-on for Unix and Linux in the Splunk Add-on for Unix and Linux manual.

The following table shows the installation locations on the distributed environment for the content pack and the add-on:

Component	Search head /cluster	Indexer / cluster	Forwarder
Content Pack for Unix Dashboards and Reports	x
Splunk Add-on for Unix and Linux	x	x	x

You can ​​automatically create entities and collect data on a recurring basis with ITSI entity integrations. The Unix and Linux entity integration uses the metrics index of itsi_im_metrics to store the metrics data collected by the Splunk Add-on for Unix and Linux. However, the content pack only works with the events index of macros os_index for events data. If you use both entity integration and the content pack, you must consider ingesting data for certain fields in both metrics and events indexes. For more information, see About Unix and Linux entity integration in ITSI, and Collect *nix data in ITSI with the Splunk Add-on for Unix and Linux

Install the Content Pack for Unix Dashboards and Reports

The Splunk App for Content Packs allows you to access content packs, preview their contents, and install them in your environment. The Splunk App for Content Packs includes the Content Pack for Unix Dashboards and Reports.

The content pack contents are automatically installed and start running when you install the Splunk App for Content Packs on the search head where you installed ITSI or IT Essentials Work.

Refer to the Splunk App for Content Packs installation instructions to install the Splunk App for Content Packs in your environment.

Create indexes

If you are migrating from Splunk App for Unix and Linux to Content Pack for Unix Dashboards and Reports, you don't need need to create the indexes as the content pack is uses the same indexes as the app.

The Content Pack for Unix Dashboards and Reports requires two indexes on the search head for indexing and showing the details of the fired alerts.

Create indexes unix_summary and firedalerts using the following resources:

• For Splunk Enterprise, see Create events indexes.
• For Splunk Cloud Platform, see Create a Splunk Cloud Platform events index.