Getting Data In

Can I injest CPU, memory,eventID data in metric index by using SPLUNK app for unix and linux ?

kate
Path Finder

Can I injest CPU, memory,eventID data in metric index by using SPLUNK app for Windows ?
I am getting data once I injest this data in event index but when I am changing the index to metric index the data stops coming to any index.

#splunkforwarder#splunkappforwindows


Labels (4)
0 Karma
1 Solution

kate
Path Finder

Thanks for the hint I was checking via index=metric_indexname query. Utilized mstat it started fetching data.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I presume you're referring to the Splunk Add-on for Windows since the app does not have any inputs.

It's not enough to change the destination index to a metrics index.  The format of the data must also change.

See https://docs.splunk.com/Documentation/AddOns/released/Windows/Configuration#Collect_perfmon_data_and... for the list of Windows metrics that are available and how to enable them.

---
If this reply helps you, Karma would be appreciated.
0 Karma

kate
Path Finder

Thanks for your response @richgalloway 
I have performed changes as suggested in the link you provided. And have restarted the splunk UF too. 
Still facing the same issue and have no error in splunkd.log.


kate_0-1708011963118.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Verify the index name specified in inputs.conf on the UF exists on the indexers.

Please share the query you're using to find the data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

kate
Path Finder

Thanks for the hint I was checking via index=metric_indexname query. Utilized mstat it started fetching data.

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...