topic Re: Do we need to enable counter in client sytem to collect in the splunk server? in Knowledge Management

Do we need to enable counter in client sytem to collect in the splunk server?

rsathish47 — Wed, 08 Jul 2015 08:48:05 GMT

Hi all,

Do we need to enable counter in client sytem to collect in the splunk server?

Thanks
Sathish R

Re: Do we need to enable counter in client sytem to collect in the splunk server?

laserval — Wed, 08 Jul 2015 09:13:45 GMT

Please clarify a bit:

Is this on Windows?
What kind of data are you trying to collect?
Do you have a Splunk Universal Forwarder installed on the client system?

Re: Do we need to enable counter in client sytem to collect in the splunk server?

rsathish47 — Wed, 08 Jul 2015 09:18:02 GMT

1) Yes it is window
2) IIS (Current Connections, Maximum Connections Total Connection Attempts )
3) yep we have installd Splunk Universal Forwarder client system.

Re: Do we need to enable counter in client sytem to collect in the splunk server?

laserval — Wed, 08 Jul 2015 09:24:39 GMT

If you want to collect data from the counters, you will need to enable them on the machine you're running IIS on. Then the forwarder can index using the perfmon input: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Real-timeWindowsperformancemonitoring#Configure_local_Windows_performance_monitoring_with_configuration_files

If you only want client connections you could index the access log files (w3c format) with a monitor input instead.

See this previous question as well: http://answers.splunk.com/answers/187236/is-there-a-way-to-see-current-connections-on-iis-s.html

Re: Do we need to enable counter in client sytem to collect in the splunk server?

rsathish47 — Wed, 08 Jul 2015 10:46:51 GMT

Thank you laserval,