- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: Windows Add-on Perfmon not working
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have configured the inputs.conf to monitor these points:
###### Splunk 5.0+ Performance Counters ######
## CPU
[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time
disabled = 0
instances = *
interval = 10
mode = single
object = Processor
useEnglishOnly=true
index=perfmon
## Logical Disk
[perfmon://LogicalDisk]
counters = % Free Space; Free Megabytes; Current Disk Queue Length; % Disk Time; Avg. Disk Queue Length; % Disk Read Time
disabled = 0
instances = *
interval = 10
mode = single
object = LogicalDisk
useEnglishOnly=true
index=perfmon
## Physical Disk
[perfmon://PhysicalDisk]
counters = Current Disk Queue Length; % Disk Time
disabled = 0
instances = *
interval = 10
mode = single
object = PhysicalDisk
useEnglishOnly=true
index=perfmon
## Memory
[perfmon://Memory]
counters = Page Faults/sec; Available Bytes; Committed Bytes
disabled = 0
interval = 10
mode = single
object = Memory
useEnglishOnly=true
index=perfmon
## Process
[perfmon://Process]
counters = % Processor Time; % User Time
disabled = 0
instances = *
interval = 10
mode = single
object = Process
useEnglishOnly=true
index=perfmon
## ProcessInformation
[perfmon://ProcessorInformation]
counters = % Processor Time; Processor Frequency
disabled = 0
instances = *
interval = 10
mode = single
object = Processor Information
useEnglishOnly=true
index=perfmon
## System
[perfmon://System]
counters = File Read Operations/sec; File Write Operations/sec; File Control Operations/sec
disabled = 0
instances = *
interval = 10
mode = single
object = System
useEnglishOnly=true
index=perfmon
but I am only getting from "Perfmon:Process"
I don't have any error messages. I don't know why I am not receiving other data too.
I am indexing two windows servers and in both cases the same thing happens to me: I only receive data from "Perfmon:Process".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I installed the universal forwarder version 7.2.1.0 I was just able to capture the data like CPU, MEMORY, LOGICAL DISK, etc. But with the version 8.0.4 or 7.3.6, it doesn't allow me to capture the data, only Perfmon:Process.e
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The first thing I would try is to simplify. You properly copied from the default `inputs.conf`, but since you did that, you only need to keep the lines that you are changing. So, try this first:
###### Splunk 5.0+ Performance Counters ######
## CPU
[perfmon://CPU]
disabled = 0
index=perfmon
## Logical Disk
[perfmon://LogicalDisk]
disabled = 0
index=perfmon
## Physical Disk
[perfmon://PhysicalDisk]
disabled = 0
index=perfmon
## Memory
[perfmon://Memory]
disabled = 0
index=perfmon
## Process
[perfmon://Process]
disabled = 0
index=perfmon
## ProcessInformation
[perfmon://ProcessorInformation]
disabled = 0
index=perfmon
## System
[perfmon://System]
disabled = 0
index=perfmon
Restart your Splunk service. If you still don't see the other sourcetypes, we'll need to see your btool output. Navigate to `$SPLUNK_HOME\bin` and run this command:
splunk cmd btool inputs list perfmon://CPU --debug
Reply to this with that output if you haven't figured it out by this point.
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I installed the universal forwarder version 7.2.1.0 I was just able to capture the data like CPU, MEMORY, LOGICAL DISK, etc. But with the version 8.0.4 or 7.3.6, it doesn't allow me to capture the data, only Perfmon:Process.e
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What later versions?
What is the output of btool from my original response?
What do you mean specifically by "it doesn't allow me"?
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is the output of the command you gave me:
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf [perfmon://CPU]
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf disabled = 1
host = splunk.cyberline.com.pe
index = default
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf instances = *
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf interval = 10
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf mode = multikv
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf object = Processor
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf useEnglishOnly = true
* Regarding the universal forwarder.
What I meant to say is that when I installed version 8.0 of the UF, it does not catch me perfmon of CPU, Memory, Logical Disk, etc. Capture only perfmon: process.
Instead, when I installed version 7.2.1.0, it was only here that I was able to capture that data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your btool output specifically says that CPU is disabled
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf disabled = 1Since this is defined in Splunk_TA_windows/default/inputs.conf, I can only assume that you have not properly saved your file Splunk_TA_windows/local/inputs.conf with a value of disabled = 0 for CPU (and likely the others).
Any stanza setting defined in local will always take precedence over default within the same app.
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That Btool command I ran on my instance which is Deployment server. My question is why should I create that configuration that you mention in my deployment-server.
If I create the local folder and specify the perfmon disable = 0 there, I will start receiving logs from that server, which I don't want to do.
In the UF I have the correct configuration, where I put disable = 0.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you run the btool command on the UF?
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is the result.
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\local\inputs.conf [perfmon://CPU]
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\local\inputs.conf disabled = 0
host = ADVANCE-PC
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\local\inputs.conf index = windows
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf instances = *
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf interval = 10
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\local\inputs.conf mode = single
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf object = Processor
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf useEnglishOnly = true
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
