Getting Data In

How do I add additional performance counters to the Splunk UF Collector?

MTravisVolker
Explorer

We are attempting to add Microsoft RAS Total counters from PerfMon to the Splunk UF collector. We updated the local/inputs.conf as follows.
alt text

These counters are available on the host but they aren't being collected by Splunk.

jgibby
Explorer

I found this useful:

Specify valid regular expressions to capture multiple performance monitor objects

instead of asterisk, you'd have to use dot-asterisk or be explicit with the object, example:

object = RAS Total

also:
If you set the useEnglishOnly attribute to true, you cannot use wildcards or regular expressions for...

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...