topic Re: For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI? in Getting Data In

For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

nbouchia — Mon, 13 Mar 2017 13:45:58 GMT

Hello

Is it possible to specify an index when you install an universal forwarder for perfmon's metrics or after with the CLI?
I don't want to modify directly the .conf file.
By default, the data is sent to "main" index.

Re: For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

nbouchia — Mon, 13 Mar 2017 14:06:23 GMT

The universal forwarder's installation is silent. Perfmon mectric are setted by flgas.

Re: For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

niketn — Mon, 13 Mar 2017 16:05:05 GMT

You can specify the inputs.conf with specific index on the Deployment Server. Based on the server class specific inputs.conf (and/or other configuration) files can be sent to various servers with Universal Forwarder.

Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Updating/Aboutdeploymentserver

Re: For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

nbouchia — Mon, 13 Mar 2017 16:11:43 GMT

Hello
Thanks for your response.
But as explained i didn't want to modify directly the conf file.
When i install a forwarder in silent mode on a server, i put the flags PERFMON=cpu,memory,network,diskspace and i would like to specify an index.
Or after install modify perfmon index using CLI.

Re: For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

adonio — Tue, 14 Mar 2017 15:09:10 GMT

Hi nbouchia,
why not use the Splunk add-on for Windows?
https://splunkbase.splunk.com/app/742/

Re: For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

gjanders — Wed, 15 Mar 2017 05:47:47 GMT

I believe the comments are valid, the Splunk deployment server is a great option here.
What we do on our many hundreds of windows servers is to deploy the forwarder with no applications installed on any platform, we simply programatically create the deploymentclient configuration such that the forwarder talks to our deployment server.

For selected windows servers we can then send down the Splunk add on for Windows which includes a local directory with the inputs.conf overriden to point to the index we want.
Alternatively you can send down a separate application which overrides the required inputs and sends the data to the correct index.

This should satisfy your requirement and provide a lot more flexibility in the future as you can change your mind about the index or rollout a newer version of the performance monitoring to all servers via the deployment server once you get it working correctly.

Re: For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

koshyk — Tue, 29 Sep 2020 13:17:03 GMT

We never configure anything via UI or CLI, but we do everything as individual app. So for example in your case what I would do is
- create an app (eg MY_windows_perfmon_inputs)
- Push the app via deployment-server to all required Windows machines
- Contents of the app below (Copied from Splunk_TA_windows)

## CPU
[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = false
instances = *
interval = 20
object = Processor
useEnglishOnly=true
index = my_custom_index

Re: For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

nbouchia — Wed, 15 Mar 2017 13:44:27 GMT

Thanks you for all comments and reply.
I'm going to have a look at the Splunk add on for Windows .