What's the performance impact of high-frequency performance sampling for Windows perfmon?

[Ranazar]

For the Windows perfmon input, I see that there's a setting that can enable high-frequency performance sampling. From the spec:

Enables high-frequency performance sampling. The input collects performance data every sampling interval. It then reports averaged data and other statistics at every interval.
The minimum legal value is 100 ...
Defaults to not specified (disabled)

I assume it's disabled by default because it generates an additional load on the forwarder, but I can't find anything that talks about what that load might be. Does anyone have an idea what kind of impact enabling this would have?

[adonio]

it actually generates load on the windows host.
think about it this way, you are collecting many performance metrics and counters via a script. you are invoking many scripts in very short intervals. That generates load on the host.
if you need very high intervals, consider maybe collectd or statsd and use some metrics power:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Metrics/GetStarted

[dstaulcu]

in addition to CPU time associated with sample taking, If you are using multikv perfmon inputs there will also be an implication to memory utilization by the perfmon collector. The sample data has to be held in memory in order to compute multi-kv stats at the end of the event interval.

[Ranazar]

Thanks for this - multikv was another item I was interested in since it apparently reduces the amount of data indexed (which would be worth the memory cost on the Windows servers).

[mstjohn_splunk]

I apologize @ranazar. In moving @adonio's comment to an answer, I accidentally deleted a comment thread. Newb move. My bad!!