Overview

Details

The Splunk on Splunk Add-on is a collection of inputs for the Splunk on Splunk (SoS) app - http://www.splunk.com/goto/sos

Important: You do not need to install the S.o.S add-on on a Splunk instance where the S.o.S app is already installed. The S.o.S app ships with the same data inputs.

What is this add-on for, then?

This S.o.St add-on allows you to pull in resource usage data from remote Splunk instances running on Linux or Unix for display in your existing instance of the Splunk on Splunk app. To enable this, install and configure this S.o.S add-on on Linux and Unix search-peers or forwarders to track the resource usage of Splunk.

NOTE: You must enable the data inputs included in this add-on before they can report resource usage information. By default, these inputs are disabled. Refer to the README file for more information.

For more details on how to set up S.o.S and its add-on to monitor Splunk's system resource usage, please refer to the following Splunk Answers:

Release Notes

Version 2.0.5

May 6, 2014

Bugs Fixed in version 2.0.5

[SUP-845] Replaced all mentions of the S.o.S "technology add-on" with
"add-on".

Version 2.0.4

May 6, 2013

Bugs Fixed in version 2.0.4

[SUP-672] Added an index definition for 'sos_summary_daily index' to indexes.conf.
[SUP-627] Fixed an issue where the ps_sos.sh scripted input would no longer print out full process arguments when executed by Splunk 5.x on Solaris.
[SUP-573] A new scripted input is now available to monitor the I/O usage of pooled search-heads on the shared NFS device: nfs-iostat_sos.py
[SUP-541] Updated the app icon.

Version 2.0.3

Dec. 16, 2012

Bugs fixed in version 2.0.3

[SUP-617] Removed an undesirable carriage return in the app.conf description string.
[SUP-568] Added an outputs.conf file with configuration that, if enabled, ensures that _internal events are forwarded.
[SUP-558] Synched up lsof_sos.sh with the version shipping in the SoS app.
[SUP-545] Adapted the ps_sos.sh scripted input to the new splunkd process command line format in 5.x.

Version 2.0.2

Aug. 25, 2012

[SUP-365] Added an app icon for the S.o.S TA for Unix and Linux.

Version 2.0.1

Dec. 16, 2011

Small changes to the README file.

Version 2.0.0

Dec. 15, 2011

11,016

Downloads

Share Subscribe

Version

Built by

Splunk Inc.

Support

Splunk Supported Questions on Splunk Answers File a case Flag as inappropriate