Getting Data In

How to make sure I am receiving CPU or memory information from my Splunk server?

antonovfr
New Member

Hi everyone,

I just started with Splunk and I am doing some testing on this software.

I have previously used Elasticsearch so I have some basic understanding of the way Splunk works.

I have a Splunk server installed on an Ubuntu VM. My Windows host is sending logs via a universal forwarder.

I would like to display and search performance informations on the Splunk server. So I went in add data, I choose my host, then host performance monitoring (translation from french) then I choose % User Time in processor, give a Test2 name, choose the "*" instance and set the interval to 10 sec. I then choose the default index.

But then I don't know where to read those information. It doesn't appear in the Search and Reporting app.

Thanks in advance for your help.

0 Karma
1 Solution

koshyk
Super Champion

The best way to tackle this is (rather than you writing everything from scratch)
- In your Windows remote machine , collect the performance metrics by adding the Perfmon Stanza as per this link to your UF
- Ensure correct indexes are present in your Splunk Enterprise while collecting them
- Ensure you install Splunk_TA_windows which does all the hard-work for you (normalising, field extraction etc.)
- Then install the Splunk App for Windows Infrastructure which will give you all dashboards and searches

View solution in original post

koshyk
Super Champion

The best way to tackle this is (rather than you writing everything from scratch)
- In your Windows remote machine , collect the performance metrics by adding the Perfmon Stanza as per this link to your UF
- Ensure correct indexes are present in your Splunk Enterprise while collecting them
- Ensure you install Splunk_TA_windows which does all the hard-work for you (normalising, field extraction etc.)
- Then install the Splunk App for Windows Infrastructure which will give you all dashboards and searches

rmanrique
Path Finder
0 Karma

antonovfr
New Member

Thanks a lot. I needed to add the perfmon Stanza in the config file of my universal forwarder

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...