topic Re: How to disable Perfmon in Getting Data In

How to disable Perfmon

eantonio — Mon, 28 Sep 2020 10:03:18 GMT

I created a batch file to install the Splunk UF:

msiexec /i splunkforwarder64bit.msi
RECEIVING_INDEXER="SERVER NAME:9997"
AGREETOLICENSE=Yes
INSTALLDIR="C:\Program Files\Splunk"
DEPLOYMENT_SERVER="SERVER NAME"
LAUNCHSPLUNK=1
SERVICESTARTTYPE=auto
WINEVENTLOG_APP_ENABLE=1
WINEVENTLOG_SEC_ENABLE=1
WINEVENTLOG_SYS_ENABLE=1
PERFMON=cpu
PERFMON=memory
PERFMON=network
PERFMON=diskspace
/quiet

I don't want the UF to send me PERFMON data anymore. How do I disable/remove it from happening?

Thank you for you help.

Re: How to disable Perfmon

_d_ — Thu, 03 Nov 2011 14:35:31 GMT

I think if you remove the following:

PERFMON=cpu PERFMON=memory PERFMON=network PERFMON=diskspace

from your command above you'll disable perfmon inputs. Alternatively, in the perfmon.conf file (of your UFs) add disabled = 1 under each stanza.

Hope this helps

> please upvote and accept answer if you find it useful - thanks!

Re: How to disable Perfmon

eantonio — Thu, 03 Nov 2011 14:37:15 GMT

where do I find the perfmon.conf file on my UF installation?

Re: How to disable Perfmon

_d_ — Thu, 03 Nov 2011 14:41:02 GMT

There is a perfmon.conf in $SPLUNK_HOME\etc\system\default\ but do not edit this. To set custom
configurations, place a modified perfmon.conf in $SPLUNK_HOME\etc\system\local\. You can also search your $SPLUNK_HOME directory (Normally C:\Program Files\SplunkUniversalForwarder) for filename perfmon.conf to get the exact location.

Re: How to disable Perfmon

eantonio — Thu, 03 Nov 2011 14:46:38 GMT

I don't see any perfmon.conf. If I will create a new file for this, do I just enter "disabled = 1" and save the file in the $SPLUNK_HOME\etc\system\local\ folder?

Re: How to disable Perfmon

eantonio — Thu, 03 Nov 2011 14:54:54 GMT

Is there a setting in Splunk Instance or Splunk Web UI to disable the collection of Perfmon data? That way, I dont have to go to each of my remote UF to disable Perfmon.

Re: How to disable Perfmon

eantonio — Fri, 04 Nov 2011 13:52:26 GMT

Is there a setting in Splunk Instance or Splunk Web UI to disable the collection of Perfmon data? That way, I dont have to go to each of my remote UF to disable Perfmon.