Hi all,
We're collecting data from a source which contains performance data for a given host on a single line, both for Windows and Linux.
I've set up a few servers and a few tags, but I'm unable to get anything working:
eventtypes.conf:
[my_cpu_eventtype]
search = index=os sourcetype=cpu_sourcetype
tags.conf
[eventtype=my_cpu_eventtype]
performance = enabled
cpu = enabled
props.conf
[cpu_sourcetype]
EXTRACT-cpu_sourcetype = ^(?P\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}),(?P[^,]+),(?P[^\r\n]+)$
FIELDALIAS-cpu_load_percent = cpu as cpu_load_percent
What am I doing wrong here?
How can this get converted into something CIM-compliant in order that this can be used in pivots?
Thanks!
Alex
↧