topic Why is our Windows universal forwarder forwarding perfmon data to main, not the perfmon index? in Getting Data In

Why is our Windows universal forwarder forwarding perfmon data to main, not the perfmon index?

ateixeira_splun — Mon, 06 Jul 2015 16:49:49 GMT

Hi,

I was checking a fresh Universal Forwarder installation I did on a Windows VM and found the following at inputs.conf, under TA subdirs:

[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
instances = *
interval = 10
object = Network Interface

[perfmon://CPUTime]
counters = % Processor Time;% User Time
disabled = 0
index = perfmon
instances = _Total
interval = 10
object = Processor
useEnglishOnly = true

The perfmon along with win events were set by me to be forwarded during the UF installation (which comes bundled with Win-TA). As you can see, CPUTime entry/stanza, like many others, is properly set to send data to perfmon index. The configuration was created by the GUI installer, after checking a few boxes for performance data collections/inputs.

However, why is Network Interface data (along with and Available Memory, CPU Load) NOT configured - by default - to be stored in the perfmon index? Is this common or maybe an issue? I’ve verified and everything is being indexed in main index instead. The perfmon index is present on the indexer though.

I am using the latest versions for UF/Indexer, downloaded last week (July-2015):

VERSION=6.2.3
BUILD=264376
PRODUCT=splunk
PLATFORM=Windows-AMD64

Any help highly appreciated.

Regards,
Alex

Re: Why is our Windows universal forwarder forwarding perfmon data to main, not the perfmon index?

kiranrm — Tue, 18 Aug 2015 06:43:40 GMT

I am also seeing a similar issue.. Any answers!!

Re: Why is our Windows universal forwarder forwarding perfmon data to main, not the perfmon index?

srisahitya_v — Tue, 18 Aug 2015 13:53:36 GMT

hi buddies,

download and install the https://splunkbase.splunk.com/app/272/ app in splunk.
after go to Splunk_home/etc/apps/windows/local--> inputs.conf
add wanted index name for every stanza. (or) copy paste same stanzas in Universal forwarder inputs.conf file.(add "index=perfmon" stanza).
check weather index=perfmon is created or not. if not create once.
restart the index and forwarder to make changes enable.

Re: Why is our Windows universal forwarder forwarding perfmon data to main, not the perfmon index?

benafo — Sun, 06 Dec 2015 23:25:27 GMT

You can edit the input.conf on the [perfmon://Network Interface] to forward events to the perfmon indexer:

[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
index = perfmon
instances = *
interval = 10
object = Network Interface