The universal forwarder's installation is silent. Perfmon mectric are setted by flgas.
You can specify the inputs.conf with specific index on the Deployment Server. Based on the server class specific inputs.conf (and/or other configuration) files can be sent to various servers with Universal Forwarder.
Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Updating/Aboutdeploymentserver
Thanks for your response.
But as explained i didn't want to modify directly the conf file.
When i install a forwarder in silent mode on a server, i put the flags PERFMON=cpu,memory,network,diskspace and i would like to specify an index.
Or after install modify perfmon index using CLI.
I believe the comments are valid, the Splunk deployment server is a great option here.
What we do on our many hundreds of windows servers is to deploy the forwarder with no applications installed on any platform, we simply programatically create the deploymentclient configuration such that the forwarder talks to our deployment server.
For selected windows servers we can then send down the Splunk add on for Windows which includes a local directory with the inputs.conf overriden to point to the index we want.
Alternatively you can send down a separate application which overrides the required inputs and sends the data to the correct index.
This should satisfy your requirement and provide a lot more flexibility in the future as you can change your mind about the index or rollout a newer version of the performance monitoring to all servers via the deployment server once you get it working correctly.
We never configure anything via UI or CLI, but we do everything as individual app. So for example in your case what I would do is
- create an app (eg MYwindowsperfmon_inputs)
- Push the app via deployment-server to all required Windows machines
- Contents of the app below (Copied from SplunkTAwindows)
## CPU [perfmon://CPU] counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec disabled = false instances = * interval = 20 object = Processor useEnglishOnly=true index = my_custom_index
Thanks you for all comments and reply.
I'm going to have a look at the Splunk add on for Windows .