All Apps and Add-ons

Is there any reason to use Perfmon over WMI on a universal forwarder when monitoring local data?

New Member

Is there any reason to use Perfmon over WMI on a Universal Forwarder when monitoring local data? Perfmon gets it's data from WMI anyways, so why add the extra step of using Perfmon when you can just hit up WMI directly? I am considering editing my Windows TA to only use WMI (ie wmi.conf) and turning off perfmon. Does anyone see any issue with this?

0 Karma
1 Solution

Builder

Hello

The perfmon handler has a few advantages over WMI. For one, it's what's used in splunk_ta_windows (currently) and thus a few applications (windows infrastructure, ITSI, XenDesktop) are expecting inputs in non-compressed perfmon format. If you are more concerned with license utilization and bandwidth utilization than app compatibility, perfmon's multi-kv option allows for compression of multiple counters and sample-interval statistics in a single event/packet.

View solution in original post

Builder

Hello

The perfmon handler has a few advantages over WMI. For one, it's what's used in splunk_ta_windows (currently) and thus a few applications (windows infrastructure, ITSI, XenDesktop) are expecting inputs in non-compressed perfmon format. If you are more concerned with license utilization and bandwidth utilization than app compatibility, perfmon's multi-kv option allows for compression of multiple counters and sample-interval statistics in a single event/packet.

View solution in original post

New Member

Thank you.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!