I created a batch file to install the Splunk UF:
msiexec /i splunkforwarder64bit.msi
RECEIVING_INDEXER="SERVER NAME:9997"
AGREETOLICENSE=Yes
INSTALLDIR="C:\Program Files\Splunk"
DEPLOYMENT_SERVER="SERVER NAME"
LAUNCHSPLUNK=1
SERVICESTARTTYPE=auto
WINEVENTLOG_APP_ENABLE=1
WINEVENTLOG_SEC_ENABLE=1
WINEVENTLOG_SYS_ENABLE=1
PERFMON=cpu
PERFMON=memory
PERFMON=network
PERFMON=diskspace
/quiet
I don't want the UF to send me PERFMON data anymore. How do I disable/remove it from happening?
Thank you for you help.
I think if you remove the following:
PERFMON=cpu
PERFMON=memory
PERFMON=network
PERFMON=diskspace
from your command above you'll disable perfmon inputs. Alternatively, in the perfmon.conf file (of your UFs) add disabled = 1
under each stanza.
Hope this helps
> please upvote and accept answer if you find it useful - thanks!
Is there a setting in Splunk Instance or Splunk Web UI to disable the collection of Perfmon data? That way, I dont have to go to each of my remote UF to disable Perfmon.
Is there a setting in Splunk Instance or Splunk Web UI to disable the collection of Perfmon data? That way, I dont have to go to each of my remote UF to disable Perfmon.
I don't see any perfmon.conf. If I will create a new file for this, do I just enter "disabled = 1" and save the file in the $SPLUNK_HOME\etc\system\local\ folder?
There is a perfmon.conf in $SPLUNK_HOME\etc\system\default\
but do not edit this. To set custom
configurations, place a modified perfmon.conf in $SPLUNK_HOME\etc\system\local\
. You can also search your $SPLUNK_HOME directory (Normally C:\Program Files\SplunkUniversalForwarder) for filename perfmon.conf to get the exact location.
where do I find the perfmon.conf file on my UF installation?