All Apps and Add-ons

Questions regarding setup of Splunk for Windows app and Perfmon configuration

adylent
Path Finder

What are the recommended Perfmon counters and procedures to properly and fully populate this app?

1)I am manually running the LookupManagement - Build searches. Should some of these builds be should be saved searches and run on intervals?

2) When I goto the summary page, I notice that no data is being shown because some of the searches reference counter="undefined" , but in my case the counter is always defined.

I'm looking for some best practices tips and guidelines here.

Thanks

0 Karma
1 Solution

adylent
Path Finder

2) This is related to the generator scripts. Run Settings -> Build Lookups -> Performance Counters -> WinApp_Lookup_Build_Perfmon - CreateNew - Detail and WinApp_Lookup_Build_Perfmon - CreateNew - Server

The issue was that the index with these events wasn't set to search by default. After verifying that was fixed, and rerunning the two searches detailed here all is well.

View solution in original post

adylent
Path Finder

2) This is related to the generator scripts. Run Settings -> Build Lookups -> Performance Counters -> WinApp_Lookup_Build_Perfmon - CreateNew - Detail and WinApp_Lookup_Build_Perfmon - CreateNew - Server

The issue was that the index with these events wasn't set to search by default. After verifying that was fixed, and rerunning the two searches detailed here all is well.

Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...