https://community.splunk.com/t5/Splunk-Enterprise/How-to-send-Windows-Perfmon-Metrics-to-a-Metrics-Index/m-p/585236#M11584 <P>I'm using Splunk Enterprise 8.2.4 and I would like to start getting my Windows Forwarder Estate (8.2.4) to send it's perform. Initially I thought this would be easy but I was wrong. I though that out of the box that Splunk would allow me collect Windows perfmon data straight to a metrics index.&nbsp; I think from reading the guide <A href="https://docs.splunk.com/Documentation/SplunkCloud/8.2.2112/Metrics/L2MOverview" target="_blank" rel="noopener">here</A> that the pattern is as follows:</P> <OL> <LI>Configure the forwarder inputs stanza as normal i.e. as you would to collect say the CPU metrics to an events index</LI> <LI>Point it at a metrics index tagged with a custom <STRONG>sourcetype</STRONG></LI> <LI>Transform/parse the event to metrics format at the indexer when received based on <STRONG>sourcetype</STRONG></LI> </OL> <P>Is this understanding correct and of so does anyone have a bundle of Transforms ready to go (perhaps a TA or app that does this like <A href="https://apps.splunk.com/app/742/" target="_blank" rel="noopener">Splunk Add-on for Microsoft Windows | Splunkbase</A>&nbsp;)?</P> Tue, 22 Feb 2022 18:19:36 GMT shocko 2022-02-22T18:19:36Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-send-Windows-Perfmon-Metrics-to-a-Metrics-Index/m-p/585236#M11584 <P>I'm using Splunk Enterprise 8.2.4 and I would like to start getting my Windows Forwarder Estate (8.2.4) to send it's perform. Initially I thought this would be easy but I was wrong. I though that out of the box that Splunk would allow me collect Windows perfmon data straight to a metrics index.&nbsp; I think from reading the guide <A href="https://docs.splunk.com/Documentation/SplunkCloud/8.2.2112/Metrics/L2MOverview" target="_blank" rel="noopener">here</A> that the pattern is as follows:</P> <OL> <LI>Configure the forwarder inputs stanza as normal i.e. as you would to collect say the CPU metrics to an events index</LI> <LI>Point it at a metrics index tagged with a custom <STRONG>sourcetype</STRONG></LI> <LI>Transform/parse the event to metrics format at the indexer when received based on <STRONG>sourcetype</STRONG></LI> </OL> <P>Is this understanding correct and of so does anyone have a bundle of Transforms ready to go (perhaps a TA or app that does this like <A href="https://apps.splunk.com/app/742/" target="_blank" rel="noopener">Splunk Add-on for Microsoft Windows | Splunkbase</A>&nbsp;)?</P> Tue, 22 Feb 2022 18:19:36 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-send-Windows-Perfmon-Metrics-to-a-Metrics-Index/m-p/585236#M11584 shocko 2022-02-22T18:19:36Z