How to disable Perfmon

[eantonio]

I created a batch file to install the Splunk UF:

msiexec /i splunkforwarder64bit.msi
RECEIVING_INDEXER="SERVER NAME:9997"
AGREETOLICENSE=Yes
INSTALLDIR="C:\Program Files\Splunk"
DEPLOYMENT_SERVER="SERVER NAME"
LAUNCHSPLUNK=1
SERVICESTARTTYPE=auto
WINEVENTLOG_APP_ENABLE=1
WINEVENTLOG_SEC_ENABLE=1
WINEVENTLOG_SYS_ENABLE=1
PERFMON=cpu
PERFMON=memory
PERFMON=network
PERFMON=diskspace
/quiet

I don't want the UF to send me PERFMON data anymore. How do I disable/remove it from happening?

Thank you for you help.

[_d_]

I think if you remove the following:

PERFMON=cpu
PERFMON=memory
PERFMON=network
PERFMON=diskspace

from your command above you'll disable perfmon inputs. Alternatively, in the perfmon.conf file (of your UFs) add disabled = 1 under each stanza.

Hope this helps

> please upvote and accept answer if you find it useful - thanks!

[eantonio]

Is there a setting in Splunk Instance or Splunk Web UI to disable the collection of Perfmon data? That way, I dont have to go to each of my remote UF to disable Perfmon.

[eantonio]

Is there a setting in Splunk Instance or Splunk Web UI to disable the collection of Perfmon data? That way, I dont have to go to each of my remote UF to disable Perfmon.

[eantonio]

I don't see any perfmon.conf. If I will create a new file for this, do I just enter "disabled = 1" and save the file in the $SPLUNK_HOME\etc\system\local\ folder?

[_d_]

There is a perfmon.conf in $SPLUNK_HOME\etc\system\default\ but do not edit this. To set custom
configurations, place a modified perfmon.conf in $SPLUNK_HOME\etc\system\local\. You can also search your $SPLUNK_HOME directory (Normally C:\Program Files\SplunkUniversalForwarder) for filename perfmon.conf to get the exact location.

[eantonio]

where do I find the perfmon.conf file on my UF installation?