Hello,
Is there any information about a timeline for PerfmonMk: support within the Splunk App for Windows Infrastructure? We upgraded half our environment to Splunk 6 and the more efficient new inputs only to find that they fell off the performance dashboard within the new application.
UPDATE:
Essentially, what needs to happen for this to work correctly is that the Performance saved searches in palettesearches.conf need to be tweaked to include the PerfmonMk: counters. It's quite tricky though because the $Counter$ token has spaces instead of underscores. Perhaps if another token is created something like this could work:
search eventtype="windows_performance" $PerfmonHost$ Host="$PerfmonHostWildcard$" object="Processor" counter="$Counter$" OR $CounterWithUnderscores$=* instance="$Instance$" | rename $CounterWithUnderscores$ as Value | stats sparkline(avg(Value)) as Trend avg(Value) as Average, max(Value) as Peak, latest(Value) as Current, latest(_time) as "Last Updated" by Host | convert ctime("Last Updated") | sort - Current | eval Average=round(Average, 2) | eval Peak=round(Peak, 2) | eval Current=round(Current, 2)
I'm not sure the best way to tackle this, and I don't want to hack the app up wildly only to have a proper fix come out soon. Any advise would be greatly appreciated. Thanks,
-Frank
