Configuration

This topic explains what happens when you activate the app after installing it on your Splunk instance. It show you how to enable or disable the inputs that come with the app, and can be used as a reference.

You can configure the Splunk Technology Add-on (TA) for Unix and Linux directly from the command line. For specific instructions on how to do so, read "Configure from the command line" later in this topic.

You can use the Splunk CLI or Splunk configuration files to enable, disable, or edit configurations for the Splunk TA for Unix and Linux.

Configure from the command line

To configure the Splunk App for Unix and Linux from the command line, use the setup.sh command:

$SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/TA-nix/bin/setup.sh

Usage

setup.sh has the following arguments:

       (no argument)   menu-based setup
       --auth          credentials (user:pass) for specified command
       --clone-all     clone input configuration from local to remote
       --disable-all   disable all inputs
       --disable-input input to be disabled
       --enable-all    enable all inputs
       --enable-input  input to be enabled
       --help          print usage and exit
       --install-app   install the app at the given location
       --interval      set input to given interval
       --list-all      show details all inputs
       --list-input    show details for input
       --usage, --?    print usage and exit
       --uri           remote uri (https://host:port) to use

Examples

To set cpu.sh interval to 120 seconds (with auth prompt):

           setup.sh --interval cpu.sh 120

To disable all local inputs (with no auth prompt):

           setup.sh --disable-all --auth admin:changeme1

To show input status on remote host foobar:

           setup.sh --list-all --uri https://foobar:8089

To update the unix app from your-server on the remote host foobar:

           setup.sh --install-app https://your-server/unix.spl --uri https://foobar:8089

To copy the local input configuration to the remote host foobar:

           setup.sh --clone-all --uri https://foobar:8089