Questions regarding setup of Splunk for Windows app and Perfmon configuration

[adylent]

What are the recommended Perfmon counters and procedures to properly and fully populate this app?

1)I am manually running the LookupManagement - Build searches. Should some of these builds be should be saved searches and run on intervals?

2) When I goto the summary page, I notice that no data is being shown because some of the searches reference counter="undefined" , but in my case the counter is always defined.

I'm looking for some best practices tips and guidelines here.

Thanks

[adylent · Accepted solution]

2) This is related to the generator scripts. Run Settings -> Build Lookups -> Performance Counters -> WinApp_Lookup_Build_Perfmon - CreateNew - Detail and WinApp_Lookup_Build_Perfmon - CreateNew - Server

The issue was that the index with these events wasn't set to search by default. After verifying that was fixed, and rerunning the two searches detailed here all is well.