Getting Data In

For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

New Member


Is it possible to specify an index when you install an universal forwarder for perfmon's metrics or after with the CLI?
I don't want to modify directly the .conf file.
By default, the data is sent to "main" index.

0 Karma

New Member

Thanks you for all comments and reply.
I'm going to have a look at the Splunk add on for Windows .

0 Karma

Super Champion

We never configure anything via UI or CLI, but we do everything as individual app. So for example in your case what I would do is
- create an app (eg MY_windows_perfmon_inputs)
- Push the app via deployment-server to all required Windows machines
- Contents of the app below (Copied from Splunk_TA_windows)

## CPU
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = false
instances = *
interval = 20
object = Processor
index = my_custom_index
0 Karma


I believe the comments are valid, the Splunk deployment server is a great option here.
What we do on our many hundreds of windows servers is to deploy the forwarder with no applications installed on any platform, we simply programatically create the deploymentclient configuration such that the forwarder talks to our deployment server.

For selected windows servers we can then send down the Splunk add on for Windows which includes a local directory with the inputs.conf overriden to point to the index we want.
Alternatively you can send down a separate application which overrides the required inputs and sends the data to the correct index.

This should satisfy your requirement and provide a lot more flexibility in the future as you can change your mind about the index or rollout a newer version of the performance monitoring to all servers via the deployment server once you get it working correctly.

0 Karma

New Member

The universal forwarder's installation is silent. Perfmon mectric are setted by flgas.

0 Karma


You can specify the inputs.conf with specific index on the Deployment Server. Based on the server class specific inputs.conf (and/or other configuration) files can be sent to various servers with Universal Forwarder.

Refer to the following documentation:

| makeresults | eval message= "Happy Splunking!!!"

New Member

Thanks for your response.
But as explained i didn't want to modify directly the conf file.
When i install a forwarder in silent mode on a server, i put the flags PERFMON=cpu,memory,network,diskspace and i would like to specify an index.
Or after install modify perfmon index using CLI.

0 Karma

Ultra Champion

Hi nbouchia,
why not use the Splunk add-on for Windows?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...