I can't seem to find any information out there and I was just curious if anyone out there knows for sure before I mess up my configs.
I've found at least one search in the Splunk App for Windows Infrastructure that doesn't support Perfmon:Mk sourtypes, which is what you get when configuring perfmon inputs with the mode = mutlikv setting. For now, I've restored my perfmon inputs to use mode = single.
This is frustrating because I found not using multikv setting has increased my license usage by 5x.
I've found at least one search in the Splunk App for Windows Infrastructure that doesn't support Perfmon:Mk sourtypes, which is what you get when configuring perfmon inputs with the mode = mutlikv setting. For now, I've restored my perfmon inputs to use mode = single.
This is frustrating because I found not using multikv setting has increased my license usage by 5x.