##
## SPDX-FileCopyrightText: 2021 Splunk, Inc. <sales@splunk.com>
## SPDX-License-Identifier: LicenseRef-Splunk-8-2021
##
##
[linux_collectd_cpu]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=cpu
#tags = performance oshost cpu inventory

[linux_collectd_memory]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=memory
#tags = performance oshost memory inventory

[linux_collectd_swap]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=swap
#tags = performance oshost memory

[linux_collectd_df]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=df
#tags = performance oshost storage inventory

[linux_collectd_interface]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=interface
#tags = performance oshost network inventory

[linux_collectd_disk]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=disk
#tags = performance oshost storage

[linux_collectd_load]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=load
#tags = performance oshost

[linux_collectd_processes]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=processes
#tags = performance oshost process cpu

[linux_collectd_protocols]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=protocols
#tags = performance oshost

[linux_collectd_irq]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=irq
#tags = performance oshost

[linux_collectd_tcpconns]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=tcpconns
#tags = performance oshost network

[linux_collectd_thermal]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=thermal
#tags = performance oshost

[linux_collectd_uptime]
search = (sourcetype=linux:collectd:graphite OR sourcetype=linux:collectd:http:json) linux_collectd_plugin=uptime
#tags = performance oshost os

[linux_audit_anomalies]
search = sourcetype=linux:audit type=ANOM_*
#tags = ids attack alert

[linux_audit_account_change]
search = sourcetype=linux:audit type IN ("ADD_GROUP", "DEL_GROUP", "GRP_MGMT", "USER_ACCT", "ADD_USER", "DEL_USER", "USER_MGMT", "USER_CHAUTHTOK")
#tags = change account

[linux_audit_authentication]
search = sourcetype=linux:audit type IN ("LOGIN", "USER_LOGIN", "USER_START", "CRED_ACQ")
#tags = authentication

[linux_audit_endpoint]
search = sourcetype=linux:audit (type=USER_CMD)
#tags = process report

[linux_audit_endpoint_services]
search = sourcetype=linux:audit type IN ("SERVICE_START", "SERVICE_STOP")
#tags = service report
