inputs.conf
Since the major release V1.7, all data generation pieces were migrated to the TA-nmon and PA-nmon add-on, these information are only valid for these add-on and the core application does not implement any input anymore
Here is the default configuration for inputs.conf file provided by the Application.
Since the Application root directory will vary depending on the fact your running the Application on a search head (Nmon core), indexer (PA-nmon) or Heavy / Universal Forwarder (TA-nmon), the normal root directory is being replace with the pattern "<root_directory>" in this configuration documentation.
See the configuration file provided within the Application to see original configuration.
Since the major release V1.7, and following Splunk requirements for certification criteria, the main working directory were migrated from $SPLUNK_HOME/var/run to $SPLUNK_HOME/var/log
01 - Nmon raw data monitor:
[monitor://$SPLUNK_HOME/var/log/nmon/var/nmon_repository/*.nmon]
disabled = false
followTail = 0
recursive = false
index = nmon
sourcetype = nmon_processing
crcSalt = <SOURCE>
This input stanza configuration is responsible in managing nmon raw data files produced by nmon binaries, themselves launched by the nmon_helper.sh script.
Because a large part of the nmon raw data file won't change until a new file is being generated, the "crcSalt" option is required.
The input is associated with the "nmon_processing" configuration in props.conf (props.conf)
When a new nmon file, or a current nmon file is updated, Splunk will output the content of the file to the converter script defined in props.conf.
02 - Nmon Performance csv data indexing:
[batch://$SPLUNK_HOME/var/log/nmon/var/csv_repository/*nmon*.csv]
disabled = false
move_policy = sinkhole
recursive = false
crcSalt = <SOURCE>
index = nmon
sourcetype = nmon_data
# source override: to prevent Metadata from having millions of entry, the source is overriden by default
# You can disable this for trouble shooting purposes if required
source = perfdata
This input monitor will index within Splunk csv data produced by nmon2csv Python or Perl converter.
Note that csv files are being indexed in "batch" mode, which means indexing and deleting files.
Under common circumstances (unless you are managing large number of nmon file for example with a NFS central nmon repositories), there shall never be any file here as they are indexed and deleted once generated.
03 - Nmon Configuration csv data indexing:
[batch://$SPLUNK_HOME/var/log/nmon/var/config_repository/*nmon*.csv]
disabled = false
move_policy = sinkhole
recursive = false
crcSalt = <SOURCE>
index = nmon
sourcetype = nmon_config
# source override: to prevent Metadata from having millions of entry, the source is overriden by default
# You can disable this for trouble shooting purposes if required
source = configdata
This input monitor will index within Splunk csv configuration data produced by nmon2csv Python or Perl converter.
This concerns the AAA and BBB* sections of nmon that contains configuration produced by the nmon binary.
Note that csv files are being indexed in "batch" mode, which means indexing and deleting files.
Nmon for Splunk will use these data to identify important information such as the type of Operating System (used to provide Operating System selector) and configuration data inventory. (see the lookup table nmon_inventory)
04 - nmon_helper.sh input script:
[script://./bin/nmon_cleaner.sh --cleancsv]
disabled = true
index = nmon
interval = 600
source = nmon_cleaner
sourcetype = nmon_clean
This input is responsible for launching nmon instances when required, it is associated with the nmon_helper.sh input script.
In default configuration, it is launched every minute, its activity is indexed within Splunk in the nmon_collect sourcetype.
Note the default status (activated / deactivated) of this input will depends on the Application concerned:
- Nmon Core (search head, standalone instance): Deactivated
- PA-nmon (clustered indexer): Activated
- TA-nmon (Heavy / Universal Forwarder): Deactivated