All Apps and Add-ons

WinEventLog:Security/Application/System events are going to perfmon index

sarmstrong_splu
Splunk Employee
Splunk Employee

When using the TA-DNSServer-NT6 TA from the Splunk for AD app (1.2.0) on a DC, the windows events from that server are not going into the 'winevents' index as they should be, instead going to the 'perfmon' index.

sarmstrong_splu
Splunk Employee
Splunk Employee

The issue appears to a comment that was left in the default/inputs.conf file. I've filed bug MSAPP-1200 to get it fixed for the next update. Removing this comment and restarting the instance resolves the issue.

#
# Perfmon Collection
#[perfmon://Processor]      <----- This is the issue.
object = Processor
counters = *
instances = *
interval = 10
disabled = 0
index=perfmon

[perfmon://Memory]
object = Memory
counters = *
interval = 10
disabled = 0
index=perfmon

[perfmon://Network_Interface]
object = Network Interface
counters = *
instances = *
interval = 10
disabled = 0
index=perfmon

[perfmon://DNS]
object = DNS
counters = *
interval = 10
disabled = 0
index=perfmon
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...