Based on other questions submited, it looks like I might be able to change the inputs.conf file but need to make sure.
what I want to do is limit the data pulled in on 'top' & 'ps'. I want to add " | HEAD 20". If I'm reading this right, I can add that command on the line following 'source = top' as I have below. is this correct? Is there a better way to accomplish this? any pointers would be appreciated.
[script://./bin/top.sh] interval = 60 sourcetype = top | head 20 (<==== new entry) source = top index = os disabled = 1