topic Re: Fully disable perfmon in Getting Data In

Fully disable perfmon

mavilla — Fri, 24 Jan 2020 00:13:59 GMT

Hello all,

I am trying to fully disable perfmon from our splunk instance as we don not use this data to monitor any of the hosts. I have disabled the setting in Splunk Web and have the data is still there when I run the query to search for perfmon data. I've read on older posts on how to disable this feature, however, I do not have the Splunk_TA for windows folder as I've never had the app to use the perfmon data. Any other guidance on how to fully disable this feature?

Thanks

Re: Fully disable perfmon

jscraig2006 — Fri, 24 Jan 2020 00:18:15 GMT

Are there UF that have the app installed? Also you might want to check SPLUNK_HOME/etc/system/local. If there is an inputs.conf with the stanza's in there.

Re: Fully disable perfmon

mavilla — Fri, 24 Jan 2020 00:19:30 GMT

there shouldn't be any UF with the app installed no

Re: Fully disable perfmon

jscraig2006 — Fri, 24 Jan 2020 00:23:12 GMT

Sorry i edited my comment as you posted.. check SPLUNK_HOME/etc/system/local. If there is an inputs.conf with the stanza's in there

Re: Fully disable perfmon

mavilla — Fri, 24 Jan 2020 00:25:37 GMT

there is not a stanza for this in that file

Re: Fully disable perfmon

jscraig2006 — Wed, 30 Sep 2020 03:48:34 GMT

do you have the Splunk_TA_microsoft_ad app installed? Run this command on on of the universal forwarder that is sending the data.

.\splunk.exe cmd btool inputs list --debug

Re: Fully disable perfmon

mavilla — Fri, 24 Jan 2020 14:27:02 GMT

I do not have this app installed either