topic Re: splunk for windows app and splunk universal forwarder in All Apps and Add-ons

splunk for windows app and splunk universal forwarder

HansK — Mon, 10 Oct 2011 14:16:35 GMT

I'm using the universal forwarder (4.2.3) to forward from windows servers to a linux splunk host ( 4.2.3, build 105575).

I've installed the windows app but it does nothing with the perfmon data received from the windows host IE. data does noet show up in the performance view. I can search for sourcetype="Perfmon:Free Disk Space" and I find loads of data.

Re: splunk for windows app and splunk universal forwarder

_d_ — Mon, 10 Oct 2011 21:26:30 GMT

Hi HansK,
It is very likely that the Windows App is still wired to use the old WMI method of capturing data from Windows machines. i.e. the app expects wmi sourcetypes/sources instead of perfmon.
Check this out for more info:
http://blogs.splunk.com/2011/04/20/sssk-1-stuff-splunkers-should-know-perfmon-wmi-collection-in-4-2/

Best,