Getting Data In

For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

nbouchia
New Member

Hello

Is it possible to specify an index when you install an universal forwarder for perfmon's metrics or after with the CLI?
I don't want to modify directly the .conf file.
By default, the data is sent to "main" index.

0 Karma

nbouchia
New Member

Thanks you for all comments and reply.
I'm going to have a look at the Splunk add on for Windows .

0 Karma

koshyk
Super Champion

We never configure anything via UI or CLI, but we do everything as individual app. So for example in your case what I would do is
- create an app (eg MY_windows_perfmon_inputs)
- Push the app via deployment-server to all required Windows machines
- Contents of the app below (Copied from Splunk_TA_windows)

## CPU
[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = false
instances = *
interval = 20
object = Processor
useEnglishOnly=true
index = my_custom_index
0 Karma

gjanders
SplunkTrust
SplunkTrust

I believe the comments are valid, the Splunk deployment server is a great option here.
What we do on our many hundreds of windows servers is to deploy the forwarder with no applications installed on any platform, we simply programatically create the deploymentclient configuration such that the forwarder talks to our deployment server.

For selected windows servers we can then send down the Splunk add on for Windows which includes a local directory with the inputs.conf overriden to point to the index we want.
Alternatively you can send down a separate application which overrides the required inputs and sends the data to the correct index.

This should satisfy your requirement and provide a lot more flexibility in the future as you can change your mind about the index or rollout a newer version of the performance monitoring to all servers via the deployment server once you get it working correctly.

0 Karma

nbouchia
New Member

The universal forwarder's installation is silent. Perfmon mectric are setted by flgas.

0 Karma

niketn
Legend

You can specify the inputs.conf with specific index on the Deployment Server. Based on the server class specific inputs.conf (and/or other configuration) files can be sent to various servers with Universal Forwarder.

Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Updating/Aboutdeploymentserver

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

nbouchia
New Member

Hello
Thanks for your response.
But as explained i didn't want to modify directly the conf file.
When i install a forwarder in silent mode on a server, i put the flags PERFMON=cpu,memory,network,diskspace and i would like to specify an index.
Or after install modify perfmon index using CLI.

0 Karma

adonio
Ultra Champion

Hi nbouchia,
why not use the Splunk add-on for Windows?
https://splunkbase.splunk.com/app/742/

0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...