For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

[nbouchia]

Hello

Is it possible to specify an index when you install an universal forwarder for perfmon's metrics or after with the CLI?
I don't want to modify directly the .conf file.
By default, the data is sent to "main" index.

[nbouchia]

Thanks you for all comments and reply.
I'm going to have a look at the Splunk add on for Windows .

[koshyk]

We never configure anything via UI or CLI, but we do everything as individual app. So for example in your case what I would do is
- create an app (eg MY_windows_perfmon_inputs)
- Push the app via deployment-server to all required Windows machines
- Contents of the app below (Copied from Splunk_TA_windows)

## CPU
[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = false
instances = *
interval = 20
object = Processor
useEnglishOnly=true
index = my_custom_index

[gjanders]

I believe the comments are valid, the Splunk deployment server is a great option here.
What we do on our many hundreds of windows servers is to deploy the forwarder with no applications installed on any platform, we simply programatically create the deploymentclient configuration such that the forwarder talks to our deployment server.

For selected windows servers we can then send down the Splunk add on for Windows which includes a local directory with the inputs.conf overriden to point to the index we want.
Alternatively you can send down a separate application which overrides the required inputs and sends the data to the correct index.

This should satisfy your requirement and provide a lot more flexibility in the future as you can change your mind about the index or rollout a newer version of the performance monitoring to all servers via the deployment server once you get it working correctly.

[nbouchia]

The universal forwarder's installation is silent. Perfmon mectric are setted by flgas.

[niketn]

You can specify the inputs.conf with specific index on the Deployment Server. Based on the server class specific inputs.conf (and/or other configuration) files can be sent to various servers with Universal Forwarder.

Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Updating/Aboutdeploymentserver

[nbouchia]

Hello
Thanks for your response.
But as explained i didn't want to modify directly the conf file.
When i install a forwarder in silent mode on a server, i put the flags PERFMON=cpu,memory,network,diskspace and i would like to specify an index.
Or after install modify perfmon index using CLI.

[adonio]

Hi nbouchia,
why not use the Splunk add-on for Windows?
https://splunkbase.splunk.com/app/742/