How do you collect Windows performance data using a custom app?

[sapanda]

Hello all,

I am new to Splunk and am trying to collect Windows performance data using a custom App rather than the Windows App. I have created an inputs.conf file with the following info:

## CPU
[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 0
instances = *
interval = 10
mode = single
object = Processor
useEnglishOnly=true
index = cust1_infra_windows

This is the data which is present in the defaults inputs.conf, but instead of collecting the data to the perfmon index, I want to collect the data to the custom index.

I deployed the app to the universal forwarder, but I do not see any data in the index (most probably, I am missing some configuration which is used in the Windows app).

Any suggestions?

Thanks in advance.

Sapan

[chrisyounger · Accepted solution]

Hi @sapanda

You should deploy the Windows app without any changes, in addition to the config you have created (provided your config is in /local/ directory). It will use your index (and your other settings) if you do this. The Windows TA does not come with enabled inputs these days. Your inputs.conf doesn't need to be in the Windows App. They can be seperate apps.

Hope this helps!

[sapanda]

Hello @chrisyoungerjds ,

Thanks for the information. Actually, I had deployed the Windows App as well as my custom app to collect the same counters( although to different indexes). After I removed the assignment for the Windows App to the universal forwarder and deployed only the custom app, the events started collecting into the custom index.

This leads me to believe that on Windows, it may cause contentions and collections to fail if we have 2 separate apps trying to collect data for the same counters. Please correct me if I am wrong.

Thanks in advance.

Sapan

[chrisyounger]

Yes that would cause a contention problem becuase the stanza (e.g. [perfmon://CPU]) has to be unique.

Anyway I am glad you solved it!